Technical Tip: Options to increase the security rating in FortiGate

Security rating is a service provided by Fortinet to understand and identify potential vulnerabilities, and highlight best practices that can be used to improve the security and performance of the network.

Further details about this is described in the Security rating documentation.

Due to various reasons, network and security administrators may need to increase the security rating on the network by excluding some devices that cause known vulnerabilities and etc.

In FortiGate, it is not possible to exclude a single device or devices from calculating the security rating, but it is possible to ignore these devices based on the port and OT signatures.

In FortiOS v7.4.x.

config ips global
    set exclude-signatures ot
end

In FortiOS v7.6.x and v8.0.x:

config system interface
    edit "port2"
        set device-identification disable 
    next
end

This will affect all the devices under that interface, where no information will be gathered for security rating calculation from any device connected via the said interface.

config system interface
    edit "wan1"
        set vdom "root"
        set device-identification enable
        set exclude-signatures iot ot
    next
end

Notes: 

Only IOT and OT signatures will be excluded.

IOT: Exclude IOT appctrl signatures.
OT: Exclude OT appctrl signatures.