Skip to main content
Duncan
Duncan
New Member
July 6, 2020
Question

Microsoft Teams SSL.Anonymous.Ciphers.Negotiation

  • July 6, 2020
  • 2 replies
  • 12902 views

Is anyone else getting SSL.Anonymous.Ciphers.Negotiation IPS notification when using Microsoft Teams? I am getting about 20 per hour with 200 staff. Haven't seen it on my PC yet even though I am running teams. The host names are:

worldaz.tr.teams.trafficmanager.net

worldaz.tr.teams.microsoft.com

    2 replies

    awomack
    awomack
    Explorer
    August 12, 2020

    Yes I am seeing the same

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    August 13, 2020

    Yep, seen as well.

    Some more info: https://www.reddit.com/r/fortinet/comments/gtc6k3/what_does_sslanonymousciphersnegotiation_alert/

     

    Jpicou
    Jpicou
    New Member
    August 21, 2020

    Seeing the same alert on Fortigate 100D and trying to confirm this is not an issue with MS Teams, because of the way MS is encrypting (see below).  As long as TLS1.2 is used this is not an issue, right?.

     

    "Man-in-the-middle attacks on media traffic between two endpoints participating in Teams audio, video, and application sharing, is prevented by using SRTP to encrypt the media stream. Cryptographic keys are negotiated between the two endpoints over a proprietary signaling protocol (Teams Call Signaling protocol) which leverages TLS 1.2 and AES-256 (in GCM mode) encrypted UDP / TCP channel."

    https://docs.microsoft.com/en-us/microsoftteams/teams-security-guide

     

    Terms & ConditionsAccessibility statement