When FortiGate enables FIPS-CC mode, the OFTP is unable to establish. From FortiGate, the connection status is UP.
While from FortiAnalyzer, there is no authorized device pop-up notification. The packet capture showed that the FortiGate reset the connection.
To successfully send logs from a FIPS-CC-enabled FortiGate to FortiAnalyzer using OFTP, both devices must use custom certificates signed by the same Certificate Authority (CA).
config system certificate oftp
set mode custom
set certificate <PEM format>
set private key <PEM private key>
end
However, there is another option that can be done from FortiAnalyzer, which is to enable the FIPS-CC mode. To enable the FIPS-CC mode:
config system fips
set status enable
set entropy-token enable
end
Enabling the FIPS-CC mode would delete all the config and logs; the command must be run at the console. Once the FIPS-CC has been enabled from the FortiAnalyzer side, the new FortiGate needs to be authorized to enable the FIPS-CC mode.
| 
