Technical Tip: How to change BIOS security level on FortiGate G series

[Gab_FTNT]

Description	This article describes how to change the security level on a G series FortiGate.
Scope	FortiGate G series.
Solution	The BIOS Security Level can be changed from the console on other FortiGate hardware models, including the FortiGate and FortiWiFi 30G and 31G:  BIOS-level signature and file integrity. On other FortiGate G-series models, a physical security-level switch is available to change the BIOS Security Level. The switch is located on the front panel of the FortiGate-70G. It is located on the rear panel of the FortiGate-90G (Gen2), 120G, and 200G series, including their variants. Refer to the following site and search for the model number. The information can be found within the Datasheet: FortiGate Hardware Guide. This switch allows changing the security level between Low and High: High – Unsigned firmware is blocked (default). Low – Unsigned firmware is allowed with a warning. Some FortiGate G series will have 3 different BIOS Security levels, such as level 0,1, or 2. Refer to this document to see the difference between those levels: Enhance BIOS-level signature and file integrity checking. The lights on the front panel will show the current security level in operation, as shown in this example. There is also a FortiGate G series model that only shows the security level light on the Front panel, but the control switch is set on the back panel as per 71G in the following example. The next step to change the security level is to reboot the device and break the booting sequence. The picture below shows the set of actions that are supposed to be taken so the security level can be changed. These are the steps to be chosen from the boot menu: I: System configuration and information R: Restricted mode 2: Disable restricted mode. Q: Quit this menu. Q: Quit menu and continue to boot. The result should be as in the 'get system status' output below. The important outputs are on the lines 'Current Security Level' and 'Physical Switch Security Level'. Once these parameters are 'low', the parameters of the FortiGate are successfully changed and ready for the needed operations (for example, installing an interim build).