FortiGate TLSv1.3 upgrade

Forum|Forum|1 year ago
October 21, 2024
7 replies
3824 views

Hello,

I recently was testing the upgrade of TLS1.2 to TLS1.3 VPN SSL settings on a 40F. I enabled TLS 1.3 support using the following CLI commands:

config vpn ssl setting

set ssl-max-proto-ver tls1-3

set ssl-min-proto-ver tls1-3

end

Now, I am unable to VPN using the FortiClient v7.0.9.0493. It should be noted that I am using Azure MFA for 2-factor authentication.

I am guessing it is a incompatibility between the VPN client and the new TLS version. TLS 1.3?? Are there any prerequisites, i.e. certificates, etc. that should be done before enforcing TLS1.3? Any thoughts and suggestions are welcomed.

AEK

SuperUser

Hello Dav

Any error message?

AEK

davbuAuthor

New Member

This is the basic error I get when trying:

kumarh

Staff

Hello,

Kindly check and edit the computer registry to enable TLS 1.3:
Go to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

If 'TLS 1.3' is not displaying as a child path under 'Protocols', create it. 'Right-click' 'Protocols', create 'new key', and name it 'TLS 1.3' as mentioned in following document : https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Windows-10-11-unable-to-connect-to-the-SSL/ta-p/274174

davbuAuthor

New Member

I'll have to try that on my personal PC as my enterprise PC locks out editing the registry.

RinoBroer

Explorer III

Why do you want to use TLS 1.3 exclusively? You might also consider using only modern cipher suites.

config vpn ssl settings
set banned-cipher RSA DHE SHA1 SHA256 SHA384 ARIA
end

Do you also have the problem with FortiClient 7.2.5.1053?