Turn off 3DES on SSL VPN

Recently my firewall was scaned by PCIDSS auditors, and they recommends to turn off 3DES in SSL VPN.

Is it possible to turn off it on 5.2.11 firmware ?

Is it safe to use 3DES in IPSEC VPN ?

New Member

it's not possible to disable 3DES in SSL VPN on a fortigate running forti os prior to 5.4.

if it's possible you should use AES in IPSEC VPN

regards,

SalasAuthor

New Member

I hope this feature will be enabled in future 5.2 firmware versions.

I have some 60d firewalls, with 5.4 firmware, but 5.2 looks much better, and i don't want to upgrade my 600c firewall cluster to 5.4 or 5.6 firmware.

New Member

Yes it is doable in 5.2.11

config vpn ssl settings set sslv3 disable set algorithm high set port 443 end

test with openssl

1: list the ciphers

openssl ciphers MEDIUM

openssl ciphers HIGH

Use the 3DES ciphers in the s_client before and after the change

e.g

;

openssl s_client -connect 1.1.1.2:443 -cipher DES-CBC3-SHA1

openssl s_client -connect 1.1.1.2:443 -cipher DES-CBC3-MD5

and so on

Sign up