FortiGate FIPS Mode Tricks

Set Fortigate Firewall into FIPS-CC Mode via Console Cable

config system fips-cc 

set status enable 

end

(you will be asked to confirm admin password)

Start bring up interface

config system interface

edit interfacename

set status up

(note this as to be done for all physical interfaces and vlan interfaces i.e. fortilink.  Default fortilink out of box requires limiting services to fabric and ping by addtional command set allowaccess fabric ping)

next

end

To mange via https, after bringing up "lan" (not just lan1-3 physical ports) do the following

set mode static

set ip xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx (ip then submask)

set allowaccess https ping

next

end

If the Switches and APs are not in or capable of FIPS mode you have to set this in the FortiGate so they can communicate correctly.

config switch-controller global
    set fips-enforce disable
end 

FortiAP's with Certified FIPS Firmware

Some APs have known factory issues, I.E. 441K which requires a firmware from Fortinet support and custom commands.

Go to your AP Profiles Page and right click your production profile and click "edit in CLI"

type "set dtls-policy dtls-enabled ipsec-vpn ipsec-sn-vpn" then hit enter

With a console cable to the AP log in and run the following commands

"cfg -a AC_DISCOVERY_TYPE=1"

"cfg -a AC_IPADDR_1=xxx.xxx.xxx.xxx" (IP of firewall/controller)

"cfg -c"

You can authorize the AP and it should be working correctly.

Credit: https://community.fortinet.com/fortigate-3/technical-tip-non-fips-fortiswitches-are-offline-when-managed-by-fortigate-configured-in-fips-cc-mode-112243