FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
btey
Staff
Staff
Article Id 283140

 

Description This article describes how to control TLS1.2 cipher suites for HTTPS administrative access.
Scope FortiGate v7.2v and v7.4.1.
Solution

By default, when strong-crypto is enabled, the cipher suites are listed below:

 

default.PNG

 

To disable the following cipher suites and keep the GCM cipher suites (TLS1.2):

  • AES256-SHA256
  • ECDHE-RSA-AES256-SHA384
  • AES128-SHA256
  • ECDHE-RSA-AES128-SHA256

 

Use the following commands to keep the GCM cipher suites (TLS1.2):

 

config system global

    set admin-https-ssl-banned-ciphers SHA256 SHA384

end

 

After the changes, run the TLS scan and the following are the available cipher suites:

 

after.PNG
Contributors