Fortinet black logo

New Features

Configurable TLS cipher suites and cipher priority order to support GUI access, FGFM tunnel, OFTP and FortiManager Web Services 7.0.2

Copy Link
Copy Doc ID c54fdd80-4935-11eb-b9ad-00505692583a:458694
Download PDF

Configurable TLS cipher suites and cipher priority order to support GUI access, FGFM tunnel, OFTP and FortiManager Web Services 7.0.2

FortiManager includes configurable TLS cipher suites and cipher priority order to support GUI access, FGFM tunnel, OFTP and FortiManager Web Services.

To configure TLS cipher suites in FortiManager:
  1. In the FortiManager CLI, set the enc-algorithm to custom using the set enc-alogorithm custom command.

    config system global

    set enc-algorithm custom

  2. Add the cipher suite entries to the ssl-cipher-suites sub table:

    config ssl-cipher-suites

    edit 1

    set cipher "TLS_RSA_WITH_AES_128_CCM"

    next

    Note

    When enc-alogorithm is not set to custom, the ssl-cipher-suites sub table is hidden in the CLI.

  3. Configure the priority of the cipher suites using the move command. The actual priority of the cipher is determined by its position in the table, not by the ID that it was created with.
    For example:

    configure ssl-cipher-suites

    move 1 after 2

    move 4 before 3

    end

    Note
    • The order of Ciphers TLS 1.2 or below is not honored.
    • After changing the cipher configuration, it may take a minute or two for the change to take effect in various services. They may temporarily go down and become unavailable during that time.
    • Upgrades will keep the enc-algorithm setting unchanged as before, with high as the default value.

Example

Below is an example for cipher suite customization:

config system global

set enc-algorithm custom

config ssl-cipher-suites

edit 1

set cipher "TLS_RSA_WITH_AES_128_CCM"

next

edit 2

set cipher "TLS_RSA_WITH_AES_256_CCM"

next

edit 4

set cipher "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"

next

edit 11

set cipher "TLS_AES_256_GCM_SHA384"

set version tls1.3

next

edit 10

set cipher "TLS_AES_128_GCM_SHA256"

set version tls1.3

next

edit 12

set cipher "TLS_CHACHA20_POLY1305_SHA256"

set version tls1.3

next

edit 5

set cipher "TLS_RSA_WITH_AES_128_CBC_SHA256"

next

end

end

As a result, we can see the cipher suite by those daemons match the customized list and order:

- https (443) 

- oftpd (514) 

- fgfm (541) 

- webservice (8080) 

 

443/tcp  open     https 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A 

|     cipher preference: server 

|_  least strength: A 

514/tcp  open     shell 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A 

541/tcp  open     uucp-rlogin 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A 

8080/tcp open     http-proxy 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A 

Configurable TLS cipher suites and cipher priority order to support GUI access, FGFM tunnel, OFTP and FortiManager Web Services 7.0.2

FortiManager includes configurable TLS cipher suites and cipher priority order to support GUI access, FGFM tunnel, OFTP and FortiManager Web Services.

To configure TLS cipher suites in FortiManager:
  1. In the FortiManager CLI, set the enc-algorithm to custom using the set enc-alogorithm custom command.

    config system global

    set enc-algorithm custom

  2. Add the cipher suite entries to the ssl-cipher-suites sub table:

    config ssl-cipher-suites

    edit 1

    set cipher "TLS_RSA_WITH_AES_128_CCM"

    next

    Note

    When enc-alogorithm is not set to custom, the ssl-cipher-suites sub table is hidden in the CLI.

  3. Configure the priority of the cipher suites using the move command. The actual priority of the cipher is determined by its position in the table, not by the ID that it was created with.
    For example:

    configure ssl-cipher-suites

    move 1 after 2

    move 4 before 3

    end

    Note
    • The order of Ciphers TLS 1.2 or below is not honored.
    • After changing the cipher configuration, it may take a minute or two for the change to take effect in various services. They may temporarily go down and become unavailable during that time.
    • Upgrades will keep the enc-algorithm setting unchanged as before, with high as the default value.

Example

Below is an example for cipher suite customization:

config system global

set enc-algorithm custom

config ssl-cipher-suites

edit 1

set cipher "TLS_RSA_WITH_AES_128_CCM"

next

edit 2

set cipher "TLS_RSA_WITH_AES_256_CCM"

next

edit 4

set cipher "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"

next

edit 11

set cipher "TLS_AES_256_GCM_SHA384"

set version tls1.3

next

edit 10

set cipher "TLS_AES_128_GCM_SHA256"

set version tls1.3

next

edit 12

set cipher "TLS_CHACHA20_POLY1305_SHA256"

set version tls1.3

next

edit 5

set cipher "TLS_RSA_WITH_AES_128_CBC_SHA256"

next

end

end

As a result, we can see the cipher suite by those daemons match the customized list and order:

- https (443) 

- oftpd (514) 

- fgfm (541) 

- webservice (8080) 

 

443/tcp  open     https 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A 

|     cipher preference: server 

|_  least strength: A 

514/tcp  open     shell 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A 

541/tcp  open     uucp-rlogin 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A 

8080/tcp open     http-proxy 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A