Configurable TLS cipher suites and cipher priority order to support GUI access, FGFM tunnel, OFTP and FortiManager Web Services 7.0.2

FortiManager includes configurable TLS cipher suites and cipher priority order to support GUI access, FGFM tunnel, OFTP and FortiManager Web Services.

To configure TLS cipher suites in FortiManager:

1. In the FortiManager CLI, set the enc-algorithm to custom using the set enc-alogorithm custom command.

   config system global

   set enc-algorithm custom

2. Add the cipher suite entries to the ssl-cipher-suites sub table:

   config ssl-cipher-suites

   edit 1

   set cipher "TLS_RSA_WITH_AES_128_CCM"

   next

   When enc-alogorithm is not set to custom, the ssl-cipher-suites sub table is hidden in the CLI.

3. Configure the priority of the cipher suites using the move command. The actual priority of the cipher is determined by its position in the table, not by the ID that it was created with.
   For example:
   

   configure ssl-cipher-suites

   move 1 after 2

   move 4 before 3

   end

   The order of Ciphers TLS 1.2 or below is not honored. After changing the cipher configuration, it may take a minute or two for the change to take effect in various services. They may temporarily go down and become unavailable during that time. Upgrades will keep the enc-algorithm setting unchanged as before, with high as the default value.

Example

Below is an example for cipher suite customization:

config system global

set enc-algorithm custom

config ssl-cipher-suites

edit 1

set cipher "TLS_RSA_WITH_AES_128_CCM"

next

edit 2

set cipher "TLS_RSA_WITH_AES_256_CCM"

next

edit 4

set cipher "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"

next

edit 11

set cipher "TLS_AES_256_GCM_SHA384"

set version tls1.3

next

edit 10

set cipher "TLS_AES_128_GCM_SHA256"

set version tls1.3

next

edit 12

set cipher "TLS_CHACHA20_POLY1305_SHA256"

set version tls1.3

next

edit 5

set cipher "TLS_RSA_WITH_AES_128_CBC_SHA256"

next

end

end

As a result, we can see the cipher suite by those daemons match the customized list and order:

- https (443) 

- oftpd (514) 

- fgfm (541) 

- webservice (8080) 

 

443/tcp  open     https 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A 

|     cipher preference: server 

|_  least strength: A 

514/tcp  open     shell 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A 

541/tcp  open     uucp-rlogin 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A 

8080/tcp open     http-proxy 

| ssl-enum-ciphers:  

|   TLSv1.2:  

|     ciphers:  

|       TLS_RSA_WITH_AES_128_CCM (rsa 2048) - A 

|       TLS_RSA_WITH_AES_256_CCM (rsa 2048) - A 

|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A 

|       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A 

|     compressors:  

|       NULL 

|     cipher preference: server 

|   TLSv1.3:  

|     ciphers:  

|       TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A 

|       TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A 

|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A 

|     cipher preference: server 

|_  least strength: A