Technical Tip: SSL/TLS CBC ciphers reported on the SAML authentication port (11444) on FortiGate

Description

This article describes a vulnerability scan finding that reports support for SSL/TLS Cipher Block Chaining (CBC) mode ciphers on the SAML authentication port of the FortiGate, together with a workaround to remove CBC cipher support from that port.

The condition is most commonly observed after IPsec VPN with SAML authentication is configured, since this is what brings the SAML authentication port into use.

Scope

FortiGate, FortiOS 7.4.x and later, IPsec VPN with SAML authentication, SSL VPN.

Solution

A vulnerability scan can report CBC mode ciphers as supported on TCP port 11444, the port used for SAML authentication (auth-ike-saml-port), while the administrative HTTPS service and the SSL VPN portal on the same FortiGate are correctly hardened and do not report the finding.

The following configuration is a typical baseline that hardens the administrative HTTPS and SSL VPN services, but does not affect the SAML authentication port:

1. Administrative HTTPS access restricted to TLS 1.3 with GCM and ChaCha20-Poly1305 cipher suites.

2. SSL VPN restricted to TLS 1.3 with the same cipher suites.
   
   

The SAML authentication port does not share its cipher configuration with the administrative HTTPS or SSL VPN portal services, and there is currently no dedicated configuration parameter to select or restrict the cipher suites used specifically on port 11444. This is why hardening steps applied to the administrative GUI and SSL VPN ports alone do not remove the CBC cipher finding on the SAML authentication port.

Workaround:

CBC mode ciphers are not part of the TLS 1.3 cipher suite set, which is limited to AEAD ciphers such as GCM and ChaCha20-Poly1305. Setting the minimum TLS protocol version to TLS 1.3 globally on the FortiGate removes CBC ciphers from every TLS-terminating service, including the SAML authentication port:

config system global
    set ssl-min-proto-version TLSv1-3
    set ssl-static-key-ciphers disable
end

This is a global setting and applies to all SSL/TLS connections on the FortiGate, not only the SAML authentication port. Testing in a non-production environment, or applying the change during a maintenance window with a rollback plan is recommended before the setting is applied to a production unit.
If the change needs to be reverted, ssl-min-proto-version can be set back to TLSv1-2.

After the change is applied, a re-scan of port 11444 confirms that CBC mode ciphers are no longer offered.

Related Article:

Technical Tip: Understanding the cipher suite 1.2 supported by Fortinet devices.