A FortiGate security audit is a structured review of your firewall’s configuration, policy, and operational state to determine whether it is actually protecting your organization the way it should be. Most businesses that run FortiGate firewalls assume they are protected. A security audit tests that assumption against the reality of what is configured, what is running, and what is being enforced. The results are often different from what IT teams expect.
This post explains what a FortiGate security audit covers, what the most common findings are, and why the gap between a deployed firewall and a properly secured one is larger than most organizations realize.
A FortiGate firewall that is powered on and passing traffic is doing something. The question a security audit answers is whether what it is doing matches what your organization actually needs from a security standpoint.
Firewalls get deployed, configured to meet the requirements of the moment, and then left largely untouched. The network changes around them. New applications are added. New users join. Old rules accumulate. Staff turn over and the person who understood the original configuration is no longer available. Firmware updates get deferred because nobody wants to risk a maintenance window. FortiGuard subscriptions approach expiry without anyone noticing because the renewal reminder goes to an inbox that is not actively monitored.
None of this makes the firewall stop passing traffic. What it does is create a growing gap between the security posture the organization thinks it has and the one it actually has. A FortiGate security audit makes that gap visible so it can be closed.
A thorough FortiGate security audit covers several distinct areas. Each one can reveal findings independently, and findings in one area often explain problems in another.
Firmware and FortiGuard status is the starting point. Fortinet releases regular FortiOS firmware updates that include security patches for known vulnerabilities. Running outdated firmware means the firewall is exposed to vulnerabilities that Fortinet has already fixed. A security audit checks the current firmware version against the latest stable release and flags the gap. It also checks whether FortiGuard subscriptions are active and receiving updates. An IPS engine running on signatures that have not been updated in six months is not providing current threat protection regardless of how well the rest of the configuration is set up.
Administrator account and access controls are reviewed next. Fortinet’s own best practices documentation is explicit on this: shared administrator accounts make it impossible to audit who made which configuration change, and they should not exist. Every administrator should have a named individual account with access limited to the scope of their role. Management access should be restricted to specific trusted hosts rather than open to any source address. Multi-factor authentication should be enabled for all administrator accounts. A security audit checks all of these and identifies any account or access control configuration that deviates from the standard.
Firewall policy review is typically where the most findings surface in an inherited or long-running environment. Policies accumulate over time. Rules get added to solve immediate problems and never get cleaned up. Overly broad rules that allow any source to any destination on wide port ranges are common. Unused rules that reference objects no longer present on the network sit quietly in the policy table doing nothing useful. Shadow rules that are never matched because a broader rule above them catches the traffic first add complexity without adding security. A security audit maps the current policy against the organization’s actual traffic requirements and identifies rules that should be tightened, merged, or removed.
Security profile activation is a critical check that catches a common and costly oversight. FortiGate bundle licenses include IPS, antivirus, application control, DNS filtering, SSL inspection, and other security services. Those services are only applied to traffic that is covered by a firewall policy with the relevant security profiles attached. It is entirely possible to have a fully licensed FortiGate where the IPS engine is running but not applied to any traffic because the security profiles are not attached to the policies. A security audit verifies that security profiles are active and applied to the right traffic flows, not just that the subscription is paid for.
SSL inspection configuration is examined specifically because it is frequently misconfigured or disabled. More than 80 percent of internet traffic is now encrypted. A FortiGate without SSL inspection enabled is passing the majority of internet-bound traffic through without inspecting it for threats. Many organizations disable SSL inspection because it caused certificate errors or application problems when first configured and nobody ever went back to fix it properly. A security audit identifies whether SSL inspection is active, which traffic it covers, and whether the certificate trust configuration is correct.
Log configuration and retention is reviewed because logs are the evidence trail that makes both incident response and compliance possible. FortiGate logs locally by default, but local storage has limited capacity and no cross-device correlation. A security audit checks what is being logged, where logs are being sent, how long they are retained, and whether the logging configuration would support an investigation if an incident occurred. Organizations without FortiAnalyzer or an equivalent log management solution often discover during an audit that their retention is far shorter than their compliance obligations require.
Network segmentation and VLAN configuration is assessed to determine whether the internal network is divided in a way that limits lateral movement. A flat network where every device can reach every other device is a significant risk amplifier: a single compromised endpoint has access to servers, other workstations, and network infrastructure without crossing any security boundary. A security audit maps the current segmentation against recognized best practice and identifies where additional segmentation would meaningfully reduce risk.
Across organizations of various sizes and industries, certain findings appear consistently in FortiGate security audits.
Outdated firmware is almost universal in environments that have not had active management. The gap between the running version and the current stable release is often significant, and the firmware in use frequently has published CVEs that have been patched in later releases.
Security profiles not applied to policies is extremely common. The subscription is paid for and the FortiGuard services are receiving updates, but the IPS or antivirus profile is not attached to the policies that cover internet-bound traffic. The service is licensed but not active on the traffic that matters most.
SSL inspection disabled or misconfigured appears in the majority of audits of environments that have been running for more than two years. It was either never enabled, disabled when it caused problems, or configured in a certificate inspection mode that does not actually decrypt and inspect traffic content.
Overly permissive firewall policies covering broad source and destination ranges appear in almost every environment that has grown organically. They typically originate from a quick fix that was never revisited.
Lapsed or soon-to-expire FortiGuard subscriptions appear frequently in environments without a managed renewal process. The firewall continues to function after a subscription lapses, but the threat intelligence services stop receiving updates, eroding protection incrementally.
A security audit produces a prioritized list of findings with recommended remediation for each one. Some findings are quick to address: enabling a security profile, restricting management access to trusted hosts, or renewing a lapsed subscription. Others require more planning: restructuring a complex policy table, implementing proper network segmentation, or deploying FortiAnalyzer for centralized log management.
The value of the audit is not just in fixing what is found. It is in establishing a documented baseline of the current security posture that can be compared against future states. Organizations with compliance obligations can use audit findings and remediation records as evidence of active security management, which is what regulators and auditors actually want to see.
For organizations that want both the audit and the ongoing management to keep the findings from recurring, a Fortinet MSSP provides continuous management that effectively makes the security audit a living process rather than a point-in-time exercise. Active firmware management, subscription renewal tracking, policy reviews, and log monitoring become ongoing disciplines rather than periodic projects.
DataCenter360 is a Fortinet Select Partner and MSSP supporting organizations with FortiGate security assessments and ongoing managed security services. If your organization has a FortiGate that has not been formally reviewed, or if you have inherited a Fortinet environment and want to understand what you actually have, reach out at [email protected] or visit our managed security services page. You can also start a conversation at datacenter360.ca/contact-us.
At minimum, a formal configuration and policy review should happen annually. In practice, organizations with active compliance obligations or fast-changing network environments benefit from more frequent reviews, either quarterly or as part of an ongoing managed service where the audit is effectively continuous. Any significant network change, such as adding a new location, deploying new applications, or onboarding a major new vendor, should trigger a targeted policy review even if a full audit is not yet due.
FortiOS includes a built-in Security Fabric rating service that analyzes the current configuration against Fortinet’s best practice recommendations and assigns a score. It covers areas including firmware status, administrator account security, policy configuration, and security profile activation. The Security Fabric rating is a useful starting point for a self-assessment, but it evaluates configuration settings rather than whether those settings are appropriate for the specific organization’s traffic patterns and risk profile. A proper security audit combines the rating tool output with a deeper review of what the policies are actually doing and whether the overall posture matches the organization’s requirements.
An internal IT team can review firmware status, check FortiGuard subscription expiry dates, and run the Security Fabric rating tool without outside help. The more complex elements of a security audit, including policy analysis, SSL inspection validation, log retention assessment, and segmentation review, require deeper FortiOS expertise and an objective perspective that is difficult to maintain when reviewing a configuration you built or inherited. Organizations that have the internal expertise can conduct meaningful self-assessments. Organizations that do not, or that want an independent review, benefit from working with a Fortinet specialist who can evaluate the environment without the familiarity bias that affects internal reviews.
A security audit is a point-in-time assessment that produces a snapshot of the current configuration and a list of findings with recommended remediation. Managed security services provide continuous management that prevents the findings from accumulating in the first place. In practice, many organizations start with an audit to understand the current state, address the findings, and then move to a managed service to keep the environment current on an ongoing basis. The audit establishes the baseline; the managed service maintains it.
DataCenter360 is a Fortinet Select Partner and MSSP supporting organizations worldwide with FortiGate security assessments and ongoing managed security services. Contact us at [email protected] or visit datacenter360.ca/contact-us to speak with a specialist.
