OpenControls Logo

STIG Viewer

STIGViewer Support

The FortiGate firewall must allow authorized users to record a packet-capture-based IP, traffic type (TCP, UDP, or ICMP), or protocol.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-234159FNFG-FW-000155SV-234159r982101_ruleCCI-001462medium
Description
Without the ability to capture, record, and log content related to a user session, investigations into suspicious user activity would be hampered. This configuration ensures the ability to select specific sessions to capture in order to support general auditing/incident investigation or to validate suspected misuse.
STIGDate
Fortinet FortiGate Firewall Security Technical Implementation Guide2025-11-19

Related Frameworks

1 mapping across 2 frameworks
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-14(2)Capture and Record Content
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-8Time Stamps
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CCI1 mapping
CCI-001462
1.00

Details

Check Text (C-234159r982101_chk)

Log in to the FortiGate GUI with Super-Admin privilege. 1. Click Network. 2. Click Packet Capture. 3. Verify different Packet Capture Filters are configured and that capture packets based on interface, host, VLAN, or protocol. If FortiGate does not allow an authorized administrator to capture packets based on interface, host, VLAN, or protocol, this is a finding.

Fix Text (F-37309r611476_fix)

Log in to the FortiGate GUI with Super-Admin privilege. Create a Packet Capture Filter 1. Click Network. 2. Click Packet Capture. 3. Click +Create New. 4. Select an interface from the drop down menu. 5. Specify the maximum number of packets to capture. 6. Enable Filters to configure filtering based upon Host (addresses), Port, VLAN, or Protocol. 7. Click OK. Then, 1. Select a packet filter from the list of packet capture filters. 2. Right-click on the selected filter. 3. Click Start. 4. Click OK. The packet capture continues until either the configured number of packets is reached, or the administrator stops the packet capture. The administrator must download the packet capture for viewing with an external application, like Wireshark or tcpdump.