Acceptance test procedure For FortiGate infrastructure.

Hi Juan

Some suggestions (this is just overall):

Physical installation:

• Check proper rack mounting
• Clean cabling
• Cable category
• Labeling is ok and follows convention
• Power redundancy
• ...

Appliance configuration:

• Check firmware version is mature and recommended
• Firmware of FGT and FSW is the recommended in compatibility matrix
• Licensing
• NTP
• DNS
• Access to FortiGuard
• Signature updates
• Network interfaces
• SMTP config
• SNMP
• Syslog
• Mail notification
• Log settings and retention
• HA tests
• No existing alarm
• ...

Appliance hardening:

• Check if the latest patch of the used firmware version is installed
• SSL certificate for GUI access
• Trusted hosts enabled
• Password policy enabled
• Nominative users
• Users are assigned the right profiles
• Admin access is disabled on WAN interfaces and DMZ
• Any unused admin access protocol is disabled
• Strong cypher
• ...

Firewall policy:

• Check rules naming convention
• Rules are hardened (no any to any, no service any and so)
• Rules are using security profiles
• Logging enabled
• Test if attack is blocked by UTM
• Test if malware is blocked
• Perform all possible traffic tests (this will also test the network layer, routing and so)
• ...

VPN:

• Test SSL VPN connection
• IPsec VPN connection
• ...