# Defense Contractors Assess FIPS-Capable Firewalls

A procurement discussion for CMMC Level 2 environments highlights that firewall selection should start with the device’s role in the system boundary: requirements may differ when it encrypts CUI, terminates VPN connections, or performs TLS inspection rather than only filtering network traffic. FortiGate 60F received a practical endorsement, including a reported third-party assessment pass, but commenters emphasized verifying the exact hardware model, firmware, configuration, and NIST cryptographic-module validation status before purchase. They also flagged firmware-update documentation, temporary deficiencies, switch compatibility, and VPN feature limitations.

- Procurement teams should map the firewall’s cryptographic functions to the CMMC assessment scope before specifying or buying a device; the discussion does not establish that every firewall must use a FIPS-validated module for every function.
- Validate the exact product and deployed configuration against the applicable NIST validation status. A general claim of FIPS capability or a successful assessment of another configuration may not establish suitability for the intended use.
- Include firmware updates, switch interoperability, and required VPN features in technical evaluation and testing. The cited WatchGuard experience notes that FIPS mode can make its built-in OpenVPN with MFA unavailable.
- The discussion cites 32 CFR 170.24(b)(1)(ii) regarding temporary deficiencies scored as “MET”; contractors should document any relevant deficiency and its treatment in the assessment context.

**Jurisdictions:** federal
**Industries:** Information Technology, Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 12, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

### Vendors
- Fortinet ()
- WatchGuard ()
- Palo Alto Networks ()
- SonicWall ()
- Cloudflare ()

### Key Quotes
> A DIBCAC High Assessment passed a WatchGuard T45-POE with FIPS enabled. Just fair warning that FIPS on WatchGuard makes its built in OpenVPN with MFA impossible as it uses non-FIPS validated modules so don't count on it for Remote VPN.
> — Community commenter (DIBCAC High Assessment experience)

> Per 32 CFR 170.24(b)(1)(ii), practices which have these types of "temporary deficiencies" are still scored as "MET."
> — Community commenter

### Sources
- [Need help choosing a firewall for FIPS 140-3 for CMMC L2](https://www.reddit.com/r/CMMC/comments/1xuexes/need_help_choosing_a_firewall_for_fips_1403_for) - reddit-cmmc