Skip to main content
stevenp
stevenp
New Member
February 12, 2025
Question

ssl error on 100D to FAZ

  • February 12, 2025
  • 2 replies
  • 780 views

Hi team

After upgrading the FAZ to 7.2.9, I have experienced out D and some of our E series can not connect to FAZ due to SSL error.

 

I have check this forum and have gone through them but still no good,

Our VMs are fine, but it looks like its only the hardware ones.

 

I have contacted support and they have gone though all the forums as well but can not get it to work.

 The software versions are all compatible

 

Is there something I should also check and test?

 

Thanks

2 replies

AEK
SuperUser
AEK
SuperUser
February 12, 2025

Hi Steven

This is probably because the D series old cypher protocols are not supported anymore on the new FAZ OS.

Try to tune the FortiAnalyzer's parameters shown in this tech tip.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Setting-SSL-Protocol-Version/ta-p/189698

AEK
    stevenp
    stevenpAuthor
    New Member
    February 12, 2025

    Hi AEK

     

    Thanks for the information. 
    I followed that link and still nothing happened.
    I have 3 D series that can not connect because of the SSL error, but the E series can.

    When I changed the the SSL settings, the E series started have issues as well.

    AEK
    SuperUser
    AEK
    SuperUser
    February 13, 2025

    Hi Steve

    I have FAZ VM 7.2.10 and FG 100D 6.2.16, and they are connected without issue.

    Here is my current FAZ config, try compare with yours.

    Type this:

    config sys globalget

    Then check these params.

    enc-algorithm : high
    fgfm-cert-exclusive : disable
    fgfm-local-cert : (null)
    fgfm-ssl-protocol : tlsv1.2
    oftp-ssl-protocol : tlsv1.2
    ssh-strong-crpto : enable
    ssl-low-encryption : disable
    ssl-protocol : tlsv1.3 tlsv1.2
    ssl-static-key-ciphers: enable
    webservice-proto : tlsv1.3 tlsv1.2

     

    AEK
      Terms & ConditionsAccessibility statement