Fortinet FortiGate Scanner

01Overview

The Fortinet FortiGate Security Scanner is a Python security-posture assessment tool that grades FortiGate next-gen firewalls against best-practice hardening, five compliance frameworks, real FortiOS CVEs, and MITRE ATT&CK resilience. It ships as two scanners that share the exact same rule engine: a live scanner that talks to the FortiOS REST API, and an offline scanner that parses an exported .conf backup with zero network access and zero third-party dependencies — purpose-built for OT, ICS, and air-gapped networks where you can't reach the firewall's management plane.

Under the hood it runs 260+ checks across 18 audit domains — admin access, firewall policy hygiene, SSL/IPsec VPN crypto, security profiles, logging, HA, certificates, network hardening, ZTNA/SD-WAN, wireless, backup/DR, and advanced FIPS-grade hardening. Beyond static config review, it does two things most config auditors don't: it matches the parsed firmware version against 66 known FortiOS CVEs (2019-2026, sourced from FortiGuard PSIRT) using train-based version logic across six release trains, and it runs 31 MITRE ATT&CK technique tests across 11 tactics to produce a 0-100% attacker-resilience score.

Every finding auto-resolves to CIS FortiGate, PCI-DSS 4.0, NIST 800-53 Rev 5, SOC 2, and HIPAA controls, and to a ready-to-paste FortiOS CLI remediation block — so the same scan feeds an auditor's evidence CSV and an engineer's fix script. It's a zero-agent, single-file design with a non-zero exit code on CRITICAL/HIGH for CI/CD gating and JSON inventory-driven fleet scanning across many firewalls at once.

It's built for firewall and network-security engineers, red/blue teams, OT/ICS security staff, and GRC auditors who need a repeatable, evidence-grade FortiGate review that works whether the box is online or locked behind an air gap.

02Key Capabilities

03Architecture

A single-file live engine (fortinet_scanner.py) holds all data (CVE list, compliance map, remediation commands) and logic (18 check methods, report mixin, multi-device orchestrator). A thin offline adapter (fortinet_offline_scanner.py) subclasses the engine and overrides only the data-access seam (_api_get), so a parsed .conf feeds the identical checks. Data flows Connect/Parse -> Collect -> Audit -> CVE match -> MITRE score -> Compliance resolve -> Report.

04Project Structure

05Security Controls

06Technology Stack

Language

Python 3.10+

Live dependency

requests (lazy-imported; only needed for REST-API mode)

Offline dependency

None — Python standard library only (stdlib re/argparse), runs on air-gapped hosts

Target API

FortiOS REST API v2 (cmdb + monitor endpoints), Bearer-token auth; FortiOS 6.x/7.x

Testing

pytest — 23 test functions in test_data/test_offline_parser.py plus sample .conf smoke fixtures

Reporting

Built-in JSON, dark-theme HTML (Catppuccin Mocha), compliance CSV, and CLI remediation exporters

Deployment

Single-file scanners, zero-agent, git clone; CI-ready via CRITICAL/HIGH exit-code gating

07Quick Start

$ git clone https://github.com/Krishcalin/Fortinet-Network-Security.git && cd Fortinet-Network-Security && pip install requests
$ python fortinet_scanner.py 10.1.1.1 --token <API-TOKEN>
$ python fortinet_scanner.py 10.1.1.1 --token <TOKEN> --json report.json --html report.html --compliance-csv audit.csv --remediation fix.txt
$ python fortinet_scanner.py --inventory devices.json --json unified_report.json
$ python fortinet_offline_scanner.py /path/to/fortigate.conf --json report.json --html report.html --severity HIGH
$ python -m pytest test_data/test_offline_parser.py -v

08Compliance & Frameworks

09Integrations & Outputs