TLS 1.3 support

FortiOS supports TLS 1.3 for Agentless VPN.

TLS 1.3 support requires IPS engine 4.205 or later and browsers that support TLS 1.3.

To establish a TLS 1.3 connection to Agentless VPN:

1. Enable TLS 1.3 support using the CLI:

   config vpn ssl setting

   set ssl-max-proto-ver tls1-3

   set ssl-min-proto-ver tls1-3

   end

2. Configure the Agentless VPN settings. See Agentless VPN for remote users.

3. Configure the firewall policy. See Firewall policy.

4. For Linux clients, ensure OpenSSL 1.1.1a is installed:

   1. Run the following commands in the Linux client terminal:

      root@PC1:~/tools# openssl

      OpenSSL> version

      If OpenSSL 1.1.1a is installed, the system displays a response like the following:

      OpenSSL 1.1.1a 20 Nov 2018

5. For Linux clients, use OpenSSL with the TLS 1.3 option to connect to Agentless VPN:

   1. Run the following command in the Linux client terminal:

      #openssl s_client -connect 10.1.100.10:10443 -tls1_3

6. Ensure the Agentless VPN connection is established with TLS 1.3 using the CLI:

   # diagnose debug application sslvpn -1

   # diagnose debug enable

   The system displays a response like the following:

   [207:root:1d]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384