New Member

Question

Need to block SSL version 3

Forum|Forum|11 years ago
March 10, 2015
19 replies
50649 views

Hi Team,

Kindly help me to block sslv3 in FortiOS 5.

Regards / Ramesh M

5.0

Show previous replies

emnoc

New Member

I don't know, but I would use a curl or similar client that allows you to test using just the protocol(s) that you have enabled. I believe curl was supported in a 3rd party package for windows. Worst case, you could fumble around with the about:config or equal and manipulate the browser to support just only the one protocol and test the web portal if enabled.

Alternatively, you can enable this still of testing with openssl

e.g

openssl s_client -tls1 -connect www.wwt.com:443

This is good for a quick test and to see what ciphers are being used between client and server.

On the FCclient, I do not recall any XML parameter that specifically spec one protocol over another. The client should negotiate a mutual support protocol with what's enabled on the fortigate. I'm sure someone would correct me if this is still not the case.

What version of FCclient are you using? I'm going to conduct my own follow up testing with the 5.2.3.370 version and a Fortigate running 5.2 and see what happens. Stay tuned.

I hope this helps

PaulM1114

New Member

I am not using a browser, I am using the SSL VPN client build into FortiClient 5.2.3.0633.

Unfortunately curl does not work on WindowsXP (something about a kernel32.dll error.)

Anyway, I will install OpenSSL and continue testing.

Thanks,

Paul

PaulM1114

New Member

Using OpenSSL (running on the same WinXP system I've been testing from) I was able to successfully connect to the FortiGate SSL VPN port using TLS 1.1 and 1.2. So the question is why can't FortiClient 5.2.3.0633 (which is also running on this WinXP laptop) connect using TLS 1.1 or 1.2 to the same FortiGate?

Paul

b_row

New Member

Paul,

Windows XP with Internet Explorer 8.0 not support TLS 1.1 and 1.2 . only Windows 7 and higher support. Validate Control Panel> Internet Options> Advanced, because you will not find support TLS 1.1 and TLS 1.2 on Windows XP stations.

Hope this helps

Internet_Options_W____XP_Portuguese.jpg

PaulM1114

New Member

Although I have Internet Explorer 8 installed on my Windows XP laptop I am not using Internet Explorer for SSL VPN.

I am using FortiClient 5.2.3.0633.

Thanks,

Paul

jaustgen

New Member

PaulM1114 wrote:
Although I have Internet Explorer 8 installed on my Windows XP laptop I am not using Internet Explorer for SSL VPN.
I am using FortiClient 5.2.3.0633.

The Fortinet client uses Internet Explorer's settings for SSL/TLS. Although these setting are in the IE settings window, they are actually intended to be the settings for all of Windows, and most programs (but not Firefox) will follow IE's settings. If you enable TLS 1.1 and 1.2 in IE settings, they will be enabled for Forticlient as well.

Since you are on IE8, these settings are not available as TLS 1.1 and 1.2 support were not added until IE9.

Since you are on XP, you cannot upgrade past IE8, so you are out of luck. You will need to upgrade your OS, or allow TLS 1.0 connections on your Fortigate.

b_row

New Member

Paul, Yes, but in this case with windows XP FortiClient SSLVPN only work with SSL2, SSL3 or TLS 1.0; Follow windows 7 supported screen without these options in active FortiClient SSLVPN connects not using TLS 1.1 and 1.2; Hope this helps

Internet_Options_W__ws_7_Portuguese.jpg

emnoc

New Member

I just notice you said "Windows XP". Why are you using an outdated unsupported OS? I doubt FTNT will lift a finger trying to make this work and support newer support SSL protocols . Just move to something supported and get away from XP imho.

emnoc

New Member

Q:

So if FC is dependent on the IE browser settings, what happens if your remove the IE browser component?