FortiGate configuration audit
Denetta Firewall Audit is the module that reads a FortiGate configuration without changing anything and audits it with 121 expert rules: it produces concrete findings across the management plane, policies and NAT, VPN, HA, security profiles and logging, names the record that triggered each finding, and writes the remediation command with the device’s real identifiers.
How is the configuration collected?
There are three paths, and all three go through the same normalizer, so the same device yields the same result:
- Backup file upload — nothing to install; the device is never contacted.
- Read-only REST API —
GETrequests only; the POST endpoint that returns a single-file backup is deliberately not used. - Collector — a service in the customer segment that only talks outbound on 443.
What does the checklist cover?
Audit coverage is measured: every item of a 189-item FortiGate checklist is either bound to a rule or recorded with the reason it isn’t (data not collectable, platform limit, out of scope). The checklist and the rules are cross-checked in CI in both directions.
| Area | Items |
|---|---|
| Management plane and admin identity | 27 |
| System, platform, licence, certificates | 17 |
| High availability (HA) | 13 |
| Interfaces, routing, segmentation signals | 16 |
| Firewall policies, NAT, published services | 37 |
| Security profiles (UTM) | 11 |
| SSL/TLS inspection | 7 |
| VPN (IPsec, SSL VPN) | 22 |
| Authentication and directory integration | 8 |
| Logging and monitoring | 12 |
| Redundancy and operational resilience | 4 |
| Virtual domains (VDOM) | 4 |
| The auditor’s own access | 5 |
| Version ⇄ CVE matching | 6 |
What do findings look like?
From the fictional FortiGate of “Örnek Firma” (Example Company):
- Critical
Unrestricted management access open from the WAN (HTTPS)
- High
ACCEPT policy with source, destination and service set to “all”
- Medium
Audit account not restricted by source IP
Why can you trust the findings?
Rules are validated against real device data: an interface is never called “unused” before its containers (zone, SD-WAN, hardware switch) are resolved, management access is judged by how effective the local-in policy is, and address groups are resolved by content. A section that could not be read is never treated as “empty”; the rule returns a “visibility gap”.
Remediation text is only displayed. Only identifiers read from the device are filled into the command; anything we don’t know stays a placeholder — a made-up command does damage when it is copied and pasted.
How is the auditor’s own access audited?
Whether the API account Denetta uses is restricted by source IP, and whether its access profile is truly read-only, are two separate rules that count towards the customer’s score. The source is the device’s own configuration, not our statement.
Let’s audit your FortiGate together.
In a meeting we can show a sample report and what would be measured on your own device.