Technical Tip: System events with description 'SSL fatal alert sent' generated on FortiGate after upgrading

There could be event logs generated on FortiGate with the description 'SSL fatal alert sent' after upgrading to FortiOS 7.0.5 or later release as an example below:

1: date=2022-03-29 time=16:07:35 eventtime=1648595255649050036 tz="-0700" logid="0105048039" type="event" subtype="wad" level="error" vd="root" logdesc="SSL fatal alert sent" session_id=0 policyid=0 srcip=0.0.0.0 srcport=0 dstip=8.8.8.8 dstport=853 action="send" alert="2" desc="certificate unknown" msg="SSL Alert sent"

The above event log is only visible in the CLI and not in the GUI. So, it will be necessary to use the following commands to view the logs.

# execute log filter category

# execute log display

Make sure to select the proper unit in the filter.

The reason for this log message is related to the below configuration on FortiGate:

# config system dns
    set primary 8.8.8.8
    set secondary 1.1.1.1
    set protocol dot
    set server-hostname "globalsdns.fortinet.net"
end

The above configuration shows that the FortiGate is configured with protocol dot but the servers used in the configuration do not support DoT, so FortiGate will log an event with 'SSL fatal alert sent' as the description.

These log messages are expected on the FortiGate.

Configure the DNS servers in FortiGate which supports DoT or disable DoT and change the configuration to cleartext by using the below commands:

# config system dns
    set primary 8.8.8.8
    set secondary 8.8.4.4
    set protocol cleartext
end

Remember that setting the protocol to cleartext would disable the ability of FortiGate to use DoT with the DNS servers.

Default FortiGuard servers that support the DoT feature could also be used.