Troubleshooting Tip: After upgrading the IPS engine to v7.01196, TLS 1.0 traffic is dropped

Description

This article describes how to handle an issue where the TLS 1.0 traffic is being dropped after upgrading the IPS engine to v7.01196 even though the FortiOS version is v7.6.6 or earlier.

Scope

FortiGate.

Solution

The TLS 1.0 drop is caused by a recent upgrade of the IPS engine to v7.01196.

IPS Attack Engine
---------
Version: 7.01196 signed
Contract Expiry Date: Fri Aug 20 2027
Last Updated using scheduled update on Wed Aug 5 03:11:10 2026
Last Update Attempt: Wed Aug 10 02:45:13 2026
Result: No Updates

The following output is observed inside of the SSL anomaly logs:

date=2026-08-10 time=11:23:45 eventtime=1786612096501738945 tz="+0400" logid="1702062101" type="utm" subtype="ssl" eventtype="ssl-negotiation" level="warning" vd="root" action="blocked" policyid=522 poluuid="f6889e34-f2a0-51f0-a2e6-3ca392aab71b" policytype="policy" sessionid=3508356123 service="SSL" profile="certificate-inspection" srcip=10.1.1.1 srcport=55555 srccountry="Reserved" dstip=10.12.1.1 dstport=999 dstcountry="Reserved" srcintf="port1" srcintfrole="lan" dstintf="port2" dstintfrole="undefined" srcuuid="0f3a285a-f20e-51f0-35de-a1f9834f69e5" dstuuid="0af1ca6e-6fcb-51ed-7bb6-f3858c1ae695" proto=6 tlsver="tls1.0" eventsubtype="unallowed-version" hostname="*.test.com" msg="SSL connection is blocked."

Even with the setting below in the SSL inspection profile, the traffic is still dropped:

config firewall ssl-ssh-profile
    edit deep-inspection
        config https
           set unsupported-ssl-version allow
        end
end

Workaround:

Switch the policy to proxy mode if access to TLS 1.0 is needed, or create FQDN addresses for the TLS 1.0 websites and set them as destinations in a firewall policy that has no-inspection ssl-ssh-profile.

The issue has been resolved in IPS Engine v7.01197. The user must manually upgrade the IPS engine. See Technical Tip: How to manually upgrade the IPS engine.

Related articles:

• Technical Tip: How to update IPS Engine to FortiGate via FortiManager

• Technical Tip: Upgrading IPS Engine on the primary FortiGate will also upgrade the backup FortiGate

• Technical Tip: How to manually update the IPS signatures definitions