TPM support for FortiGate-VM

Using the TPM module, the FortiGate can generate, store, and authenticate cryptographic keys. When TPM is enabled on a FortiGate, the admin must set a 32-digit hexadecimal master-encryption-password to encrypt sensitive data on the FortiGate such as admin passwords, IPsec VPN preshared keys (PSK), and other passwords and keys as this document lists. In turn, a TPM-generated primary key, which is stored on the TPM, encrypts this master-encryption-passsword.

When the FortiGate backs up configurations to a configuration file, the master-encryption-password encrypts passwords and keys. The primary key also encrypts the master-encryption-password. Therefore, when restoring a config file, if the FortiGate unit does not have TPM enabled, or does not have the same master-encryption-key, you cannot upload the configuration file.

This enhancement adds TPM support to FGT-VM64 platforms. Hypervisors with software TPM emulator packages installed can support the TPM feature in FortiOS. This feature supports KVM/QEMU.

For information about TPM, see Trusted platform module support.

Passwords and keys that the masterencryptionkey can encrypt include:

Alert email user password
BGP and other routing-related configurations
External resource
FortiGuard proxy password
FortiToken/FortiToken Mobile seed
High availability password
Link Monitor server-side password
IPsec VPN PSK
Local certificate private key
SDN connector server-side password
Local, LDAP, RADIUS, FSSO, and other user category-related passwords
Modem/PPPoE
NST password
NTP Password
SNMP
Wireless security-related password

You cannot restore a private key-encrypted configuration via the FortiOS GUI if private-data-encryption is disabled. The following shows the GUI in this scenario:

To check if your FortiGate has a TPM:

Verify that the required packages are installed on the Linux KVM host:

packet@kvm-s01:~$ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 22.04.1 LTS Release: 22.04 Codename: jammy packet@kvm-s01:~$ packet@kvm-s01:~$ apt list swtpm swtpm-tools qemu libvirt0 virtinst Listing... Done libvirt0/jammy-updates,jammy-updates,now 8.0.0-1ubuntu7.1 amd64 [installed,automatic] qemu/jammy-updates,jammy-updates,now 1:6.2+dfsg-2ubuntu6.3 amd64 [installed] swtpm-tools/jammy,jammy,now 0.6.3-0ubuntu3 amd64 [installed] swtpm/jammy,jammy,now 0.6.3-0ubuntu3 amd64 [installed] virtinst/jammy,jammy,jammy,jammy,now 1:4.0.0-1 all [installed]

Import a FGT_VM64_KVM VM to the host. You may want to change the following script to fit your setup:

UUID="$(uuid)"
SKU="FGT_VM64_KVM"
VER=7
NUM=0418
CPU=2
RAM=2048
CONTROLLER="type=ide,index=0"
BUS="ide"
MODEL="virtio"
RND_MAC() { printf '90:6C:AC:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256)) ;}
MACADDR=$(RND_MAC)
DOMAIN=$SKU-v$VER-b$NUM

qemu-img create -f qcow2 $DOMAIN-log.qcow2 1024M
qemu-img create -f qcow2 $DOMAIN-wanopt.qcow2 1024M

virt-install --connect qemu:///system \
	--name $DOMAIN \
	--uuid $UUID \
	--virt-type kvm \
	--arch=x86_64 \
	--hvm \
	--osinfo linux \
	--os-variant=generic \
	--graphics vnc,listen=0.0.0.0 --noautoconsole \
	--cpu host-passthrough \
	--vcpus=$CPU \
	--ram $RAM \
	--sysinfo host \
	--controller $CONTROLLER \
	--boot hd,menu=on \
	--disk fortios.qcow2,device=disk,bus=$BUS,format=qcow2,cache=none,io=native \
	--disk $DOMAIN-log.qcow2,device=disk,bus=$BUS,format=qcow2,cache=none,io=native \
	--disk $DOMAIN-wanopt.qcow2,device=disk,bus=$BUS,format=qcow2,cache=none,io=native \
	--features kvm_hidden=on,smm=on \
	--tpm backend.type=emulator,backend.version=2.0,model=tpm-tis \
	--network bridge=br1,model=$MODEL,mac=$MACADDR:01 \
	--network bridge=br2,model=$MODEL,mac=$MACADDR:02 \
	--network bridge=br3,model=$MODEL,mac=$MACADDR:03 \
	--network bridge=br4,model=$MODEL,mac=$MACADDR:04 \
	--import

Key pairs are created on the host when the VM with TPM is imported:

packet@kvm-s01:~$ sudo ls -al /var/lib/swtpm-localca/ total 56 drwxr-x--- 2 swtpm root 4096 Sep 21 08:09 . drwxr-xr-x 49 root root 4096 Sep 19 12:42 .. -rwxr-xr-x 1 swtpm swtpm 0 Sep 21 08:09 .lock.swtpm-localca -rw-r--r-- 1 swtpm swtpm 5519 Sep 21 08:09 01.pem -rw-r--r-- 1 swtpm swtpm 1 Sep 21 08:19 certserial -rw-r--r-- 1 swtpm swtpm 48 Sep 21 08:09 index.txt -rw-r--r-- 1 swtpm swtpm 21 Sep 21 08:09 index.txt.attr -rw-r--r-- 1 swtpm swtpm 0 Sep 21 08:09 index.txt.old -rw-r--r-- 1 swtpm swtpm 5519 Sep 21 08:09 issuercert.pem -rw-r--r-- 1 swtpm swtpm 3 Sep 21 08:09 serial -rw-r--r-- 1 swtpm swtpm 3 Sep 21 08:09 serial.old -rw-r----- 1 swtpm swtpm 2459 Sep 21 08:09 signkey.pem -rw-r--r-- 1 swtpm swtpm 1468 Sep 21 08:09 swtpm-localca-rootca-cert.pem -rw-r----- 1 swtpm swtpm 2459 Sep 21 08:09 swtpm-localca-rootca-privkey.pem packet@kvm-s01:~$ packet@kvm-s01:~$ sudo cat /var/log/swtpm/libvirt/qemu/FGT_VM64_KVM_v7.0.8_b0418-swtpm.log Starting vTPM manufacturing as swtpm:swtpm @ Wed 21 Sep 2023 08:09:30 AM PDT Successfully created RSA 2048 EK with handle 0x81010001. Invoking /usr/lib/x86_64-linux-gnu/swtpm/swtpm-localca --type ek --ek b0a85bad0cb79ef673f05f4d3fdb4f65da3171d86a392e60435c18a431a3062aafaadb22e2af06b2522cfcf959ca334ba38684859beb8064f2ba610735cb1dccee1388b9da840a4732d626358e383f0d089592d04dfc15b7e82285f1fa1b4a73bd1bfdbf0d75a02f94f069ae1546d2f28f984046f384f4b35ef1451a191628b2a1329f138dad4e4407d0d03b2f71defc568642fe74d98f0e383e8ac1a5c94b4c30c1a0aae0cfe96bc9316397582cbbb834557a2112aad32d3f1e825e8dfbd569bb9b2492728c425609515568f17d42aee8a5fdaf973a441aaf8bf20762101a9e2507ee0b4e876280e36474b4c10179df18fe066db708d0c11e741a8e722154c9 --dir /var/lib/libvirt/swtpm/eb3c65cc-d354-11ea-a7dc-08002799a4d5/tpm2 --logfile /var/log/swtpm/libvirt/qemu/FGT_VM64_KVM_v7.0.8_b0418-swtpm.log --vmid FGT_VM64_KVM_v7.0.8_b0418:eb3c65cc-d354-11ea-a7dc-08002799a4d5 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 164 --tpm-manufacturer id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2 --configfile /etc/swtpm-localca.conf --optsfile /etc/swtpm-localca.options Creating root CA and a local CA's signing key and issuer cert. Successfully created EK certificate locally. Invoking /usr/lib/x86_64-linux-gnu/swtpm/swtpm-localca --type platform --ek b0a85bad0cb79ef673f05f4d3fdb4f65da3171d86a392e60435c18a431a3062aafaadb22e2af06b2522cfcf959ca334ba38684859beb8064f2ba610735cb1dccee1388b9da840a4732d626358e383f0d089592d04dfc15b7e82285f1fa1b4a73bd1bfdbf0d75a02f94f069ae1546d2f28f984046f384f4b35ef1451a191628b2a1329f138dad4e4407d0d03b2f71defc568642fe74d98f0e383e8ac1a5c94b4c30c1a0aae0cfe96bc9316397582cbbb834557a2112aad32d3f1e825e8dfbd569bb9b2492728c425609515568f17d42aee8a5fdaf973a441aaf8bf20762101a9e2507ee0b4e876280e36474b4c10179df18fe066db708d0c11e741a8e722154c9 --dir /var/lib/libvirt/swtpm/eb3c65cc-d354-11ea-a7dc-08002799a4d5/tpm2 --logfile /var/log/swtpm/libvirt/qemu/FGT_VM64_KVM_v7.0.8_b0418-swtpm.log --vmid FGT_VM64_KVM_v7.0.8_b0418:eb3c65cc-d354-11ea-a7dc-08002799a4d5 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 164 --tpm-manufacturer id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2 --configfile /etc/swtpm-localca.conf --optsfile /etc/swtpm-localca.options Successfully created platform certificate locally. Successfully created NVRAM area 0x1c00002 for RSA 2048 EK certificate. Successfully created NVRAM area 0x1c08000 for platform certificate. Successfully created ECC EK with handle 0x81010016. Invoking /usr/lib/x86_64-linux-gnu/swtpm/swtpm-localca --type ek --ek x=d28e9411dbe9aa0ada17c179c0854bebcf2d7ef2f94f42ef92f4e2deb28b568c9ecabd847fd36a974efceb7b0d54893e,y=6b777ed060459c7907eb639665b3e64d9a93e692b7a4c0d20a18acafb6a2ae8e1284e948060266b96c1c23cc883e7634,id=secp384r1 --dir /var/lib/libvirt/swtpm/eb3c65cc-d354-11ea-a7dc-08002799a4d5/tpm2 --logfile /var/log/swtpm/libvirt/qemu/FGT_VM64_KVM_v7.0.8_b0418-swtpm.log --vmid FGT_VM64_KVM_v7.0.8_b0418:eb3c65cc-d354-11ea-a7dc-08002799a4d5 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 164 --tpm-manufacturer id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2 --configfile /etc/swtpm-localca.conf --optsfile /etc/swtpm-localca.options Successfully created EK certificate locally. Successfully created NVRAM area 0x1c00016 for ECC EK certificate. Successfully activated PCR banks sha1,sha256 among sha1,sha256,sha384,sha512. Successfully authored TPM state. Ending vTPM manufacturing @ Wed 21 Sep 2023 08:09:33 AM PDT Starting vTPM manufacturing as swtpm:swtpm @ Wed 21 Sep 2023 08:19:44 AM PDT Successfully created RSA 2048 EK with handle 0x81010001. Invoking /usr/lib/x86_64-linux-gnu/swtpm/swtpm-localca --type ek --ek b49eb6d250c2add268fe448098b458f57e3a47719c3fbcc49fb85ecddd937f2f662a238eee0b8814ea3c07a4beeebad5a4ef30fd224e9051fad2ae29256ba7b85b03aef004ec05d2fd1e8139edcb3396b0b2b0a2adfb6b29fd975a9daf385aa3ffc0739fbc2d6b5850b9f424c787074ac56571fc15564b3dfbd847f2c79d310dfea27f2a694bb2c49d3bbb2e2d2a61c29d4214140358dfe23b97562ea8c756da7942e8be3b260da9dfccb26383c4734c76d6e8e47e55055c1a697c1379faf3b41400034b201115fb0913151f0a1d4b963208e5f758ad9c59ee1da145d2bc740069768545085d18a00108915214014b8b99fb47611f8b9260c70a4e2cef3ce1c7 --dir /var/lib/libvirt/swtpm/eb3c65cc-d354-11ea-a7dc-08002799a4d5/tpm2 --logfile /var/log/swtpm/libvirt/qemu/FGT_VM64_KVM_v7.0.8_b0418-swtpm.log --vmid FGT_VM64_KVM_v7.0.8_b0418:eb3c65cc-d354-11ea-a7dc-08002799a4d5 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 164 --tpm-manufacturer id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2 --configfile /etc/swtpm-localca.conf --optsfile /etc/swtpm-localca.options Successfully created EK certificate locally. Invoking /usr/lib/x86_64-linux-gnu/swtpm/swtpm-localca --type platform --ek b49eb6d250c2add268fe448098b458f57e3a47719c3fbcc49fb85ecddd937f2f662a238eee0b8814ea3c07a4beeebad5a4ef30fd224e9051fad2ae29256ba7b85b03aef004ec05d2fd1e8139edcb3396b0b2b0a2adfb6b29fd975a9daf385aa3ffc0739fbc2d6b5850b9f424c787074ac56571fc15564b3dfbd847f2c79d310dfea27f2a694bb2c49d3bbb2e2d2a61c29d4214140358dfe23b97562ea8c756da7942e8be3b260da9dfccb26383c4734c76d6e8e47e55055c1a697c1379faf3b41400034b201115fb0913151f0a1d4b963208e5f758ad9c59ee1da145d2bc740069768545085d18a00108915214014b8b99fb47611f8b9260c70a4e2cef3ce1c7 --dir /var/lib/libvirt/swtpm/eb3c65cc-d354-11ea-a7dc-08002799a4d5/tpm2 --logfile /var/log/swtpm/libvirt/qemu/FGT_VM64_KVM_v7.0.8_b0418-swtpm.log --vmid FGT_VM64_KVM_v7.0.8_b0418:eb3c65cc-d354-11ea-a7dc-08002799a4d5 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 164 --tpm-manufacturer id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2 --configfile /etc/swtpm-localca.conf --optsfile /etc/swtpm-localca.options Successfully created platform certificate locally. Successfully created NVRAM area 0x1c00002 for RSA 2048 EK certificate. Successfully created NVRAM area 0x1c08000 for platform certificate. Successfully created ECC EK with handle 0x81010016. Invoking /usr/lib/x86_64-linux-gnu/swtpm/swtpm-localca --type ek --ek x=56a69f0827e7f4fc237dffb8202573f910140516ced4d85f62b443b627d6eb3075993a5e757119ed56ab43daa76e5f23,y=c38364e2663bcb8cab92a658c2f4054826ca36d6cff99ea0a7a2ef9f600bf5902902482a67ad90101930ed7f17cc613d,id=secp384r1 --dir /var/lib/libvirt/swtpm/eb3c65cc-d354-11ea-a7dc-08002799a4d5/tpm2 --logfile /var/log/swtpm/libvirt/qemu/FGT_VM64_KVM_v7.0.8_b0418-swtpm.log --vmid FGT_VM64_KVM_v7.0.8_b0418:eb3c65cc-d354-11ea-a7dc-08002799a4d5 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 164 --tpm-manufacturer id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2 --configfile /etc/swtpm-localca.conf --optsfile /etc/swtpm-localca.options Successfully created EK certificate locally. Successfully created NVRAM area 0x1c00016 for ECC EK certificate. Successfully activated PCR banks sha1,sha256 among sha1,sha256,sha384,sha512. Successfully authored TPM state. Ending vTPM manufacturing @ Wed 21 Sep 2023 08:19:44 AM PDT

Version: FortiGate-VM64-KVM v7.0.8,build0418,220920 (GA)
Virus-DB: 1.00000(2018-04-09 18:07)
Extended DB: 1.00000(2018-04-09 18:07)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 0.00000(2001-01-01 00:00)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 6.00741(2015-12-01 02:30)
APP-DB: 6.00741(2015-12-01 02:30)
INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
Serial-Number: FGVM02TM12345678
License Status: Valid
License Expiration Date: 2023-09-08
VM Resources: 2 CPU/2 allowed, 2007 MB RAM
Log hard disk: Available
Hostname: FGT_VM64_KVM
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 0418
Release Version Information: GA
FortiOS x86-64: Yes
System time: Wed Sep 21 08:43:18 2023
Last reboot reason: warm reboot

FGT_VM64_KVM #
FGT_VM64_KVM # fnsysctl ls /dev/tpm0
/dev/tpm0  

FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose hardware deviceinfo tpm


TPM capability information of fixed properties:
=========================================================
TPM_PT_FAMILY_INDICATOR:        2.0
TPM_PT_LEVEL:                   0
TPM_PT_REVISION:                164
TPM_PT_DAY_OF_YEAR:             75
TPM_PT_YEAR:                    2021
TPM_PT_MANUFACTURER:            IBM
TPM_PT_VENDOR_STRING:           SW   TPM
TPM_PT_VENDOR_STRING_1 in HEX:  0x53572020
TPM_PT_VENDOR_STRING_2 in HEX:  0x2054504d
TPM_PT_VENDOR_STRING_3 in HEX:  0x00000000
TPM_PT_VENDOR_STRING_4 in HEX:  0x00000000
TPM_PT_VENDOR_TPM_TYPE:         1
TPM_PT_FIRMWARE_VERSION:        8217.4131.22.13878
TPM_PT_FIRMWARE_VERSION in HEX: 0x2019102300163636

TPM_PT_MEMORY:
=========================================================
Shared RAM:                     0 CLEAR
Shared NV:                      1 SET
Object Copied To Ram:           1 SET

TPM_PT_PERMANENT:
=========================================================
Owner Auth Set:                 0 CLEAR
Sendorsement Auth Set:          0 CLEAR
Lockout Auth Set:               0 CLEAR
Disable Clear:                  0 CLEAR
In Lockout:                     0 CLEAR
TPM Generated EPS:              1 SET



FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose tpm 
get-property              Get TPM properties. [Take 0-1 arg(s)]
get-var-property          Get TPM var properties.
read-clock                Read TPM internal clock.
shutdown-prepare          Prepare for TPM power cycle.
selftest                  Perform self tests.
generate-random-number    Generate a 4-byte random number
SHA-1                     HASH a sequence of num with SHA-1 algo
SHA-256                   HASH a sequence of num with SHA-256 algo
 
FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose tpm get-property 


TPM capability information of fixed properties:
=========================================================
TPM_PT_FAMILY_INDICATOR:        2.0
TPM_PT_LEVEL:                   0
TPM_PT_REVISION:                164
TPM_PT_DAY_OF_YEAR:             75
TPM_PT_YEAR:                    2021
TPM_PT_MANUFACTURER:            IBM
TPM_PT_VENDOR_STRING:           SW   TPM
TPM_PT_VENDOR_STRING_1 in HEX:  0x53572020
TPM_PT_VENDOR_STRING_2 in HEX:  0x2054504d
TPM_PT_VENDOR_STRING_3 in HEX:  0x00000000
TPM_PT_VENDOR_STRING_4 in HEX:  0x00000000
TPM_PT_VENDOR_TPM_TYPE:         1
TPM_PT_FIRMWARE_VERSION:        8217.4131.22.13878
TPM_PT_FIRMWARE_VERSION in HEX: 0x2019102300163636

TPM_PT_MEMORY:
=========================================================
Shared RAM:                     0 CLEAR
Shared NV:                      1 SET
Object Copied To Ram:           1 SET

TPM_PT_PERMANENT:
=========================================================
Owner Auth Set:                 0 CLEAR
Sendorsement Auth Set:          0 CLEAR
Lockout Auth Set:               0 CLEAR
Disable Clear:                  0 CLEAR
In Lockout:                     0 CLEAR
TPM Generated EPS:              1 SET



FGT_VM64_KVM # diagnose tpm get-var-property


TPM capability information of variable properties:



TPM_PT_STARTUP_CLEAR:
=========================================================
Ph Enable:                      1 SET
Sh Enable:                      1 SET
Eh Enable:                      1 SET
Orderly:                        0 CLEAR



FGT_VM64_KVM # diagnose tpm read-clock


Clock info:
=========================================================
Time since the last TPM_Init:
2375158 ms  =  0 y, 0 d, 0 h, 39 min, 35 s, 158 ms

Time during which the TPM has been powered:
2375319 ms  =  0 y, 0 d, 0 h, 39 min, 35 s, 319 ms

TPM Reset since the last TPM2_Clear:            5
Number of times that TPM2_Shutdown:             0
Safe:                                           1 = Yes



FGT_VM64_KVM # diagnose tpm shutdown-prepare

Shutdown works as expected.



FGT_VM64_KVM # diagnose tpm selftest

Successfully tested. Works as expected.



FGT_VM64_KVM # diagnose tpm generate-random-number

Random value:

0x00000000:   0x73  0xF1  0x9F  0x31  


FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose tpm SHA-1 1234567890abcdef1234567890abcdef
1234567890abcdef1234567890abcdef


TPM2_Hash of '1234567890abcdef1234567890abcdef' with SHA-1:

0x00000000:   62  0A  31  15  69  9A  42  2B  
0x00000008:   D8  74  DE  31  D3  E6  91  1C  
0x00000010:   58  3A  76  75  


FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose tpm SHA-256 1234567890abcdef1234567890abcdef
1234567890abcdef1234567890abcdef


TPM2_Hash of '1234567890abcdef1234567890abcdef' with SHA-256:

0x00000000:   C5  12  D9  2E  35  45  B2  F1  
0x00000008:   22  2E  4B  4C  6A  F6  D3  30  
0x00000010:   EC  30  02  A0  4B  CA  A4  1D  
0x00000018:   F9  CC  2C  49  62  84  96  D6

Enable TPM and input the master encryption password. This is an example. Using 0123456789abcdef0123456789abcdef as your private key is not recommended:

FGT_VM64_KVM # exec private-encryption-key sample
Private encryption is not enabled.
Command fail. Return code 7

FGT_VM64_KVM # 
FGT_VM64_KVM # config system global

FGT_VM64_KVM (global) # set private-data-encryption enable

FGT_VM64_KVM (global) # end
Please type your private data encryption key (32 hexadecimal numbers):
1234567890abcdef1234567890abcdef
Please re-enter your private data encryption key (32 hexadecimal numbers) again:
1234567890abcdef1234567890abcdef
Your private data encryption key is accepted.

The following shows an example of a successful activation:

FGT_VM64_KVM # exec private-encryption-key sample B64TEXT: u7oOx1iBjPFu4XLZVq5/RpoZrDJ9htRo6Jjhfts4BaI= B64HMAC: FHmUhzSyT0IEfyoRnfdTFbY2l0o=

Note the B64TEXT and B64HMAC sample keys. Run the following to verify the feature:

FGT_VM64_KVM # exec private-encryption-key verify u7oOx1iBjPFu4XLZVq5/RpoZrDJ9htRo6Jjhfts4BaI= FHmUhzSyT0IEfyoRnfdTFbY2l0o= Verification passed.

Back up the config:

FGT_VM64_KVM # execute backup config tftp FGVM02TM12345678.conf 172.18.70.161 Please wait... Connect to tftp server 172.18.70.161 ... # Send config file to tftp server OK.

Verify that the backup config has private-encryption-key:

packet@1804:/mnt/incoming$ less FGVM02TM12345678.conf #config-version=FGVMK6-7.0.8-FW-build0418-220920:opmode=0:vdom=0:user=admin #conf_file_ver=2079893748141389 #buildno=0418 #global_vdom=1 #private-encryption-key=oY5GhQK3w0Ddn0EX+8hp6UYpjB4= config system global set admin-server-cert "Fortinet_Factory" set alias "FortiGate-VM64-KVM" set hostname "FGT_VM64_KVM" set private-data-encryption enable set timezone 04 end

Factory reset the FortiGate and restore the backup config. If private-data-encryption is disabled, the restore fails:

FGT_VM64_KVM # execute factoryreset keepvmlicense
This operation will reset the system to factory default except VM license!
Do you want to continue? (y/n)y


System is resetting to factory default...


The system is going down NOW !!

FGT_VM64_KVM # 

After reboot:

FGT_VM64_KVM # execute restore config tftp FGVM02TM12345678.conf 172.18.70.161
This operation will overwrite the current setting and could possibly reboot the system!
Do you want to continue? (y/n)y

Please wait...
Connect to TFTP server 172.18.70.161 ...

Get file from TFTP server OK.
The configuration was encrypted with a private encryption key but encryption is not enabled. Required: Enable private-data-encryption under system.global.
Command fail. Return code -910

The backup config restore fails if private-data-encryption is enabled with a incorrect master key:

FGT_VM64_KVM # config system global

FGT_VM64_KVM (global) # set private-data-encryption enable

FGT_VM64_KVM (global) # end
Please type your private data encryption key (32 hexadecimal numbers):
ac6bdcdee2701a1edc6d594898e34f50
Please re-enter your private data encryption key (32 hexadecimal numbers) again:
ac6bdcdee2701a1edc6d594898e34f50
Your private data encryption key is accepted.

FGT_VM64_KVM # 
FGT_VM64_KVM # execute restore config tftp FGVM02TM12345678.conf 172.18.70.161
This operation will overwrite the current setting and could possibly reboot the system!
Do you want to continue? (y/n)y

Please wait...
Connect to TFTP server 172.18.70.161 ...

Get file from TFTP server OK.
The configuration was encrypted with a private encryption key that does not match the current in-use private encryption key.
Command fail. Return code -911

You can only restore the backup config when private-data-encryption is enabled with the correct master key.

FGT_VM64_KVM # config system global 

FGT_VM64_KVM (global) # set private-data-encryption disable 

FGT_VM64_KVM (global) # end

FGT_VM64_KVM # 
FGT_VM64_KVM # config system global 

FGT_VM64_KVM (global) # set private-data-encryption enable 

FGT_VM64_KVM (global) # end
Please type your private data encryption key (32 hexadecimal numbers):
1234567890abcdef1234567890abcdef
Please re-enter your private data encryption key (32 hexadecimal numbers) again:
1234567890abcdef1234567890abcdef
Your private data encryption key is accepted.

FGT_VM64_KVM # execute restore config tftp FGVM02TM12345678.conf 172.18.70.161
This operation will overwrite the current setting and could possibly reboot the system!
Do you want to continue? (y/n)y

Please wait...
Connect to TFTP server 172.18.70.161 ...

Get file from TFTP server OK.
File check OK.

FGT_VM64_KVM # 

The system is going down NOW !!

Please stand by while rebooting the system.

TPM support for FortiGate-VM

This enhancement adds TPM support to FGT-VM64 platforms. Hypervisors with software TPM emulator packages installed can support the TPM feature in FortiOS. This feature supports KVM/QEMU.

For information about TPM, see Trusted platform module support.

Passwords and keys that the masterencryptionkey can encrypt include:

Alert email user password
BGP and other routing-related configurations
External resource
FortiGuard proxy password
FortiToken/FortiToken Mobile seed
High availability password
Link Monitor server-side password
IPsec VPN PSK
Local certificate private key
SDN connector server-side password
Local, LDAP, RADIUS, FSSO, and other user category-related passwords
Modem/PPPoE
NST password
NTP Password
SNMP
Wireless security-related password

You cannot restore a private key-encrypted configuration via the FortiOS GUI if private-data-encryption is disabled. The following shows the GUI in this scenario:

To check if your FortiGate has a TPM:

Verify that the required packages are installed on the Linux KVM host:

Import a FGT_VM64_KVM VM to the host. You may want to change the following script to fit your setup:

UUID="$(uuid)"
SKU="FGT_VM64_KVM"
VER=7
NUM=0418
CPU=2
RAM=2048
CONTROLLER="type=ide,index=0"
BUS="ide"
MODEL="virtio"
RND_MAC() { printf '90:6C:AC:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256)) ;}
MACADDR=$(RND_MAC)
DOMAIN=$SKU-v$VER-b$NUM

qemu-img create -f qcow2 $DOMAIN-log.qcow2 1024M
qemu-img create -f qcow2 $DOMAIN-wanopt.qcow2 1024M

virt-install --connect qemu:///system \
	--name $DOMAIN \
	--uuid $UUID \
	--virt-type kvm \
	--arch=x86_64 \
	--hvm \
	--osinfo linux \
	--os-variant=generic \
	--graphics vnc,listen=0.0.0.0 --noautoconsole \
	--cpu host-passthrough \
	--vcpus=$CPU \
	--ram $RAM \
	--sysinfo host \
	--controller $CONTROLLER \
	--boot hd,menu=on \
	--disk fortios.qcow2,device=disk,bus=$BUS,format=qcow2,cache=none,io=native \
	--disk $DOMAIN-log.qcow2,device=disk,bus=$BUS,format=qcow2,cache=none,io=native \
	--disk $DOMAIN-wanopt.qcow2,device=disk,bus=$BUS,format=qcow2,cache=none,io=native \
	--features kvm_hidden=on,smm=on \
	--tpm backend.type=emulator,backend.version=2.0,model=tpm-tis \
	--network bridge=br1,model=$MODEL,mac=$MACADDR:01 \
	--network bridge=br2,model=$MODEL,mac=$MACADDR:02 \
	--network bridge=br3,model=$MODEL,mac=$MACADDR:03 \
	--network bridge=br4,model=$MODEL,mac=$MACADDR:04 \
	--import

Key pairs are created on the host when the VM with TPM is imported:

Version: FortiGate-VM64-KVM v7.0.8,build0418,220920 (GA)
Virus-DB: 1.00000(2018-04-09 18:07)
Extended DB: 1.00000(2018-04-09 18:07)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 0.00000(2001-01-01 00:00)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 6.00741(2015-12-01 02:30)
APP-DB: 6.00741(2015-12-01 02:30)
INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
Serial-Number: FGVM02TM12345678
License Status: Valid
License Expiration Date: 2023-09-08
VM Resources: 2 CPU/2 allowed, 2007 MB RAM
Log hard disk: Available
Hostname: FGT_VM64_KVM
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 0418
Release Version Information: GA
FortiOS x86-64: Yes
System time: Wed Sep 21 08:43:18 2023
Last reboot reason: warm reboot

FGT_VM64_KVM #
FGT_VM64_KVM # fnsysctl ls /dev/tpm0
/dev/tpm0  

FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose hardware deviceinfo tpm


TPM capability information of fixed properties:
=========================================================
TPM_PT_FAMILY_INDICATOR:        2.0
TPM_PT_LEVEL:                   0
TPM_PT_REVISION:                164
TPM_PT_DAY_OF_YEAR:             75
TPM_PT_YEAR:                    2021
TPM_PT_MANUFACTURER:            IBM
TPM_PT_VENDOR_STRING:           SW   TPM
TPM_PT_VENDOR_STRING_1 in HEX:  0x53572020
TPM_PT_VENDOR_STRING_2 in HEX:  0x2054504d
TPM_PT_VENDOR_STRING_3 in HEX:  0x00000000
TPM_PT_VENDOR_STRING_4 in HEX:  0x00000000
TPM_PT_VENDOR_TPM_TYPE:         1
TPM_PT_FIRMWARE_VERSION:        8217.4131.22.13878
TPM_PT_FIRMWARE_VERSION in HEX: 0x2019102300163636

TPM_PT_MEMORY:
=========================================================
Shared RAM:                     0 CLEAR
Shared NV:                      1 SET
Object Copied To Ram:           1 SET

TPM_PT_PERMANENT:
=========================================================
Owner Auth Set:                 0 CLEAR
Sendorsement Auth Set:          0 CLEAR
Lockout Auth Set:               0 CLEAR
Disable Clear:                  0 CLEAR
In Lockout:                     0 CLEAR
TPM Generated EPS:              1 SET



FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose tpm 
get-property              Get TPM properties. [Take 0-1 arg(s)]
get-var-property          Get TPM var properties.
read-clock                Read TPM internal clock.
shutdown-prepare          Prepare for TPM power cycle.
selftest                  Perform self tests.
generate-random-number    Generate a 4-byte random number
SHA-1                     HASH a sequence of num with SHA-1 algo
SHA-256                   HASH a sequence of num with SHA-256 algo
 
FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose tpm get-property 


TPM capability information of fixed properties:
=========================================================
TPM_PT_FAMILY_INDICATOR:        2.0
TPM_PT_LEVEL:                   0
TPM_PT_REVISION:                164
TPM_PT_DAY_OF_YEAR:             75
TPM_PT_YEAR:                    2021
TPM_PT_MANUFACTURER:            IBM
TPM_PT_VENDOR_STRING:           SW   TPM
TPM_PT_VENDOR_STRING_1 in HEX:  0x53572020
TPM_PT_VENDOR_STRING_2 in HEX:  0x2054504d
TPM_PT_VENDOR_STRING_3 in HEX:  0x00000000
TPM_PT_VENDOR_STRING_4 in HEX:  0x00000000
TPM_PT_VENDOR_TPM_TYPE:         1
TPM_PT_FIRMWARE_VERSION:        8217.4131.22.13878
TPM_PT_FIRMWARE_VERSION in HEX: 0x2019102300163636

TPM_PT_MEMORY:
=========================================================
Shared RAM:                     0 CLEAR
Shared NV:                      1 SET
Object Copied To Ram:           1 SET

TPM_PT_PERMANENT:
=========================================================
Owner Auth Set:                 0 CLEAR
Sendorsement Auth Set:          0 CLEAR
Lockout Auth Set:               0 CLEAR
Disable Clear:                  0 CLEAR
In Lockout:                     0 CLEAR
TPM Generated EPS:              1 SET



FGT_VM64_KVM # diagnose tpm get-var-property


TPM capability information of variable properties:



TPM_PT_STARTUP_CLEAR:
=========================================================
Ph Enable:                      1 SET
Sh Enable:                      1 SET
Eh Enable:                      1 SET
Orderly:                        0 CLEAR



FGT_VM64_KVM # diagnose tpm read-clock


Clock info:
=========================================================
Time since the last TPM_Init:
2375158 ms  =  0 y, 0 d, 0 h, 39 min, 35 s, 158 ms

Time during which the TPM has been powered:
2375319 ms  =  0 y, 0 d, 0 h, 39 min, 35 s, 319 ms

TPM Reset since the last TPM2_Clear:            5
Number of times that TPM2_Shutdown:             0
Safe:                                           1 = Yes



FGT_VM64_KVM # diagnose tpm shutdown-prepare

Shutdown works as expected.



FGT_VM64_KVM # diagnose tpm selftest

Successfully tested. Works as expected.



FGT_VM64_KVM # diagnose tpm generate-random-number

Random value:

0x00000000:   0x73  0xF1  0x9F  0x31  


FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose tpm SHA-1 1234567890abcdef1234567890abcdef
1234567890abcdef1234567890abcdef


TPM2_Hash of '1234567890abcdef1234567890abcdef' with SHA-1:

0x00000000:   62  0A  31  15  69  9A  42  2B  
0x00000008:   D8  74  DE  31  D3  E6  91  1C  
0x00000010:   58  3A  76  75  


FGT_VM64_KVM # 
FGT_VM64_KVM # diagnose tpm SHA-256 1234567890abcdef1234567890abcdef
1234567890abcdef1234567890abcdef


TPM2_Hash of '1234567890abcdef1234567890abcdef' with SHA-256:

0x00000000:   C5  12  D9  2E  35  45  B2  F1  
0x00000008:   22  2E  4B  4C  6A  F6  D3  30  
0x00000010:   EC  30  02  A0  4B  CA  A4  1D  
0x00000018:   F9  CC  2C  49  62  84  96  D6

Enable TPM and input the master encryption password. This is an example. Using 0123456789abcdef0123456789abcdef as your private key is not recommended:

FGT_VM64_KVM # exec private-encryption-key sample
Private encryption is not enabled.
Command fail. Return code 7

FGT_VM64_KVM # 
FGT_VM64_KVM # config system global

FGT_VM64_KVM (global) # set private-data-encryption enable

FGT_VM64_KVM (global) # end
Please type your private data encryption key (32 hexadecimal numbers):
1234567890abcdef1234567890abcdef
Please re-enter your private data encryption key (32 hexadecimal numbers) again:
1234567890abcdef1234567890abcdef
Your private data encryption key is accepted.

The following shows an example of a successful activation:

FGT_VM64_KVM # exec private-encryption-key sample B64TEXT: u7oOx1iBjPFu4XLZVq5/RpoZrDJ9htRo6Jjhfts4BaI= B64HMAC: FHmUhzSyT0IEfyoRnfdTFbY2l0o=

Note the B64TEXT and B64HMAC sample keys. Run the following to verify the feature:

FGT_VM64_KVM # exec private-encryption-key verify u7oOx1iBjPFu4XLZVq5/RpoZrDJ9htRo6Jjhfts4BaI= FHmUhzSyT0IEfyoRnfdTFbY2l0o= Verification passed.

Back up the config:

FGT_VM64_KVM # execute backup config tftp FGVM02TM12345678.conf 172.18.70.161 Please wait... Connect to tftp server 172.18.70.161 ... # Send config file to tftp server OK.

Verify that the backup config has private-encryption-key:

Factory reset the FortiGate and restore the backup config. If private-data-encryption is disabled, the restore fails:

FGT_VM64_KVM # execute factoryreset keepvmlicense
This operation will reset the system to factory default except VM license!
Do you want to continue? (y/n)y


System is resetting to factory default...


The system is going down NOW !!

FGT_VM64_KVM # 

After reboot:

FGT_VM64_KVM # execute restore config tftp FGVM02TM12345678.conf 172.18.70.161
This operation will overwrite the current setting and could possibly reboot the system!
Do you want to continue? (y/n)y

Please wait...
Connect to TFTP server 172.18.70.161 ...

Get file from TFTP server OK.
The configuration was encrypted with a private encryption key but encryption is not enabled. Required: Enable private-data-encryption under system.global.
Command fail. Return code -910

The backup config restore fails if private-data-encryption is enabled with a incorrect master key:

FGT_VM64_KVM # config system global

FGT_VM64_KVM (global) # set private-data-encryption enable

FGT_VM64_KVM (global) # end
Please type your private data encryption key (32 hexadecimal numbers):
ac6bdcdee2701a1edc6d594898e34f50
Please re-enter your private data encryption key (32 hexadecimal numbers) again:
ac6bdcdee2701a1edc6d594898e34f50
Your private data encryption key is accepted.

FGT_VM64_KVM # 
FGT_VM64_KVM # execute restore config tftp FGVM02TM12345678.conf 172.18.70.161
This operation will overwrite the current setting and could possibly reboot the system!
Do you want to continue? (y/n)y

Please wait...
Connect to TFTP server 172.18.70.161 ...

Get file from TFTP server OK.
The configuration was encrypted with a private encryption key that does not match the current in-use private encryption key.
Command fail. Return code -911

You can only restore the backup config when private-data-encryption is enabled with the correct master key.

FGT_VM64_KVM # config system global 

FGT_VM64_KVM (global) # set private-data-encryption disable 

FGT_VM64_KVM (global) # end

FGT_VM64_KVM # 
FGT_VM64_KVM # config system global 

FGT_VM64_KVM (global) # set private-data-encryption enable 

FGT_VM64_KVM (global) # end
Please type your private data encryption key (32 hexadecimal numbers):
1234567890abcdef1234567890abcdef
Please re-enter your private data encryption key (32 hexadecimal numbers) again:
1234567890abcdef1234567890abcdef
Your private data encryption key is accepted.

FGT_VM64_KVM # execute restore config tftp FGVM02TM12345678.conf 172.18.70.161
This operation will overwrite the current setting and could possibly reboot the system!
Do you want to continue? (y/n)y

Please wait...
Connect to TFTP server 172.18.70.161 ...

Get file from TFTP server OK.
File check OK.

FGT_VM64_KVM # 

The system is going down NOW !!

Please stand by while rebooting the system.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

Administration Guide

TPM support for FortiGate-VM

TPM support for FortiGate-VM

To check if your FortiGate has a TPM:

TPM support for FortiGate-VM

TPM support for FortiGate-VM

To check if your FortiGate has a TPM: