Technical Tip: Setting ssl-server-algorithm custom for Virtual Servers can fail with return code -651 and 'wrong-ssl-version'

Description

This article describes a known issue for FortiOS v7.6.5+ and FortiOS v8.0.0 where the FortiGate CLI will fail to apply the set ssl-server-algorithm custom under specific circumstances. When the issue occurs, the FortiGate may produce a message similar to the following:

FortiGate (Test_VS) # set ssl-server-algorithm custom 
version tls-1.2 from server cipher 1 is lower than ssl-server-min-version wrong-ssl-version
node_check_object fail! for ssl-server-algorithm custom

value parse error before 'custom'
Command fail. Return code -651

Scope

FortiOS v7.6.5 to v7.6.7, v8.0.0; Virtual Servers.

Solution

To trigger this issue, a specific set of circumstances must be present:

• A Virtual Server set to server-type https and ssl-mode full.

• The administrator attempts to set ssl-server-algorithm custom while at least one entry exists under config ssl-server-cipher-suites.

• ssl-server-min-version and ssl-server-max-version must be set to client.

• FortiGate must be running FortiOS v7.6.5 through v7.6.7, or v8.0.0 (v7.6.4 and earlier are not impacted).

The following is an example flow that demonstrates the problem. This first code block shows that first-time setup occurs without issue:

FortiGate # config firewall vip

FortiGate (vip) # edit Test_VS

FortiGate (Test_VS) # show
config firewall vip
    edit "Test_VS"
        set type server-load-balance
        set server-type https
        set extip 1.2.3.4
        set extintf "internal1"
        set extport 443
        set ssl-mode full
        set ssl-certificate "Fortinet_Factory"
    next
end

FortiGate (Test_VS) # show full-configuration | grep ssl-server
        set ssl-server-algorithm client
        set ssl-server-min-version client
        set ssl-server-max-version client
        set ssl-server-renegotiation enable
        set ssl-server-session-state-type both
        set ssl-server-session-state-timeout 60
        set ssl-server-session-state-max 100

FortiGate (Test_VS) # set ssl-server-algorithm custom

FortiGate (Test_VS) # config ssl-server-cipher-suites

FortiGate (ssl-server-cipher-suites) # edit 1
new entry '1' added

FortiGate (1) # set cipher TLS-AES-256-GCM-SHA384

FortiGate (1) # end

FortiGate (Test_VS) # show
config firewall vip
    edit "Test_VS"
        set type server-load-balance
        set server-type https
        set extip 1.2.3.4
        set extintf "internal1"
        set extport 443
        set ssl-mode full
        set ssl-certificate "Fortinet_Factory"
        set ssl-server-algorithm custom
        config ssl-server-cipher-suites
            edit 1
                set cipher TLS-AES-256-GCM-SHA384
                set versions tls-1.3
            next
        end
    next
end

FortiGate (Test_VS) # end

FortiGate # 

Subsequent attempts to set ssl-server-algorithm to custom result in error code -651 and the change not being applied. Notably, this issue also occurs when ssl-server-algorithm is changed away from custom and then attempted to be changed back:

FortiGate # config firewall vip

FortiGate (vip) # edit Test_VS

FortiGate (Test_VS) # show
config firewall vip
    edit "Test_VS"
        set type server-load-balance
        set server-type https
        set extip 1.2.3.4
        set extintf "internal1"
        set extport 443
        set ssl-mode full
        set ssl-certificate "Fortinet_Factory"
        set ssl-server-algorithm custom
        config ssl-server-cipher-suites
            edit 1
                set cipher TLS-AES-256-GCM-SHA384
                set versions tls-1.3
            next
        end
    next
end

FortiGate (Test_VS) # set ssl-server-algorithm custom
version tls-1.3 from server cipher 1 is lower than ssl-server-min-version wrong-ssl-version
node_check_object fail! for ssl-server-algorithm custom

value parse error before 'custom'
Command fail. Return code -651

FortiGate (Test_VS) # set ssl-server-algorithm high

FortiGate (Test_VS) # show
config firewall vip
    edit "Test_VS"
        set type server-load-balance
        set server-type https
        set extip 1.2.3.4
        set extintf "internal1"
        set extport 443
        set ssl-mode full
        set ssl-certificate "Fortinet_Factory"
        ssl-server-algorithm high
    next
end

FortiGate (Test_VS) # set ssl-server-algorithm custom
version tls-1.3 from server cipher 1 is lower than ssl-server-min-version wrong-ssl-version
node_check_object fail! for ssl-server-algorithm custom

value parse error before 'custom'
Command fail. Return code -651

Resolution and workaround:

This issue is being tracked as part of Bug 1308113 and will be resolved in FortiOS v7.6.8, v8.0.1, and above. In the meantime, it is possible to work around the issue by changing ssl-server-min-version and ssl-server-max-version to a setting other than client. Note that the ciphers set under config ssl-server-cipher-suites must fall within this version range; otherwise, an error will occur (e.g., the FortiGate will not commit ssl-server-min-version tls-1.3 when TLS 1.2 ciphers have already been configured):

For more details on the cipher suite, see Technical Tip: Understanding the cipher suite 1.2 supported by Fortinet devices.

config firewall vip
    edit <name>
        set ssl-server-min-version tls-1.2
        set ssl-server-max-version tls-1.3
    next
end

Once the above has been configured, it will become possible to freely set/unset ssl-server-algorithm custom without encountering any errors.

Related document:

FortiGate encryption algorithm cipher suites