Troubleshoot FortiGate Authenticated Scans with  Restricted Users

Problem

Authentication fails during scans on the FortiGate firewall.

Cause

The scan uses a user account with insufficient privileges. A read-only user cannot run required system commands, such as the get system status command.

Solution

To troubleshoot FortiGate Authenticated Scans with  Restricted Users:

1. Run a debug scan to investigate the issue.
2. Create a Search List with these QIDs: 45017, 45038, 82004, 82023, 45039, 38307, 105053, 105297
3. Assign the Search List to the Option Profile used for the debug scan. 
   For detailed steps, refer to Automated Debug Scan for VM Internal Scanner.
4. Run the debug scan.
5. Review QID 105053 in the scan results to check authentication output.
6. Verify the CLI prompt in FortiGate:
   • $ indicates a restricted (read-only) user
   • # indicates a privileged (admin) user
7. Ensure the scan user has sufficient privileges to run required commands.
8. Confirm all required FortiOS authentication commands work as expected. For more information, refer to Privilege level for FortiOS.
   You may update the user to a higher privilege level, as required.