Skip to main content
pjang
Staff & Editor
pjang
Staff & Editor
November 30, 2022

Technical Tip: How to configure DNP3 Proxy on FortiGate Rugged

  • November 30, 2022
  • 3 replies
  • 2441 views
Description

This article describes how to configure a FortiGate Rugged unit to act as a DNP3 proxy server. With this functionality, the FortiGate-Rugged can receive TCP/IP-based DNP3 polls from a Master station and act as a network proxy for a Remote Terminal Unit (RTU) attached to its onboard DB9 serial port.
Scope

FortiGate Rugged on FortiOS 7.0 and later (dnp3-proxy is not present on non-Rugged FortiGates).
Solution

DNP3 proxy functionality can be configured under 'config system dnp3-proxy' as follows:

 

config system dnp3-proxy

    set status <enable | disable>

    set port <1-65535, default = 20000>

    set term-baudrate <19200 | 38400, default = 19200>

    set term-databits <0-65535, default = 8>

    set term-stopbits <0-65535, default = 1>

    set term-parity <none | odd | even, default = none>

    set term-flowcontrol <none | xon_xoff | hardware, default = none>

end

 

The interface receiving the DNP traffic must have DNP allowed.

 

config system interface

    edit <interface>

        append allowaccess dnp

    next

end

 

Important notes:

  • The 'set status' option was added in FortiOS 7.0.8 and 7.2.4. Prior to this, DNP3 proxy functionality was always enabled for FortiGate-Rugged units with no option to disable it (See Bug #686135 in the FortiOS Release Notes).
  • In FortiOS v7.0.8 and v7.2.4, the 'set term-baudrate 9600' option was removed. The option was restored starting in FortiOS v7.2.8 and v7.4.4. See Issue ID# 929896 in Resolved Issues.

 

Troubleshooting Commands:

  • Administrators can run the following diagnostic commands to view debug output for the DNP process on the FortiGate Rugged.

diagnose debug reset
diagnose debug application dnp -1
diagnose debug enable

  • A packet capture on the FortiGate is also recommended to confirming polls are arriving successfully from the DNP3 Master.

diagnose sniffer packet any 'port 20000' 6 100 l

3 replies

I
ICSNOOB22
New Member
May 19, 2026

What port do I use on the FGR-70F? Also, do you have a serial pinout? Struggling at this time to get serial data from our DNP device(s).

M
Mohsin01
New Member
May 19, 2026

useful technical breakdown. One thing worth adding for anyone implementing a DNP3 proxy in an OT environment is that the authentication configuration deserves careful attention beyond the basic proxy setup. DNP3 Secure Authentication v5 integration with FortiGate requires matching the challenge response timing parameters to the actual field device capabilities because older RTUs and IEDs often have tighter timing tolerances than the default FortiGate configuration assumes.

It is also worth noting that logging verbosity on the DNP3 proxy can generate significant log volume in active SCADA environments. Tuning the log filter to capture anomalous traffic patterns rather than routine polling cycles keeps the data actionable without overwhelming the SIEM or FortiAnalyzer storage.

The Rugged platform specifically handles temperature and environmental variation well for substation deployments, but the DNP3 proxy performance under sustained high polling frequency from multiple master stations is worth load testing before full production deployment. Did you encounter any latency sensitivity issues with the proxied DNP3 traffic during testing, or did the throughput hold up cleanly across the tested configuration?

I
ICSNOOB22
New Member
May 19, 2026

So at this time it is in a lab. My scans are not making it though the FW. I am trying to make sure my config is setup, physically and logically is correct. I am trying to use the COM2 port and a loopback interface as the ip address for the scans.

Terms & ConditionsAccessibility statement