Description
This article describes how to enable the private-data-encryption feature on a standalone FortiGate.
Scope
FortiGate v6.2+.
Solution
The Private Data Encryption feature on FortiGate devices is designed to enhance security by encrypting sensitive configuration data stored on the device. This feature is crucial in scenarios where preventing unauthorized access to sensitive information is essential, even in the event of physical access to the device.
With the Private Data Encryption feature enabled, passwords and private keys used in certificates on the FortiGate are encrypted using a predefined private key. They are encoded when displayed in the CLI and configuration files, ensuring they cannot be decrypted without the private key, and are never displayed in clear text. To restore a system from a configuration file on another FortiGate, the same private key is required.
By default, the Trusted Platform Module (TPM) is disabled. To enable it, set a 32-digit hexadecimal master encryption password, which encrypts sensitive data on the FortiGate using AES-128-CBC. This password is then used by TPM to generate a 2048-bit primary key, which secures the master encryption password through RSA-2048 encryption. The master encryption password protects the data, while the primary key protects the master encryption password. The TPM module does not encrypt the disk drive of eligible FortiGates.
To enable TPM and input the master‑encryption‑password:
config system global
set private-data-encryption enable
end
Please type your private data encryption key (32 hexadecimal numbers):
********************************
Please re-enter your private data encryption key (32 hexadecimal numbers) again:
********************************
Your private data encryption key is accepted.
Important note:
This is a 32-character user must create and input (hexadecimal = characters a,b,c,d,e,f and digits). This is not a software-generated key and may not contain special characters (execute private-encryption-key sample: this command does not create an example key for use above).
If forgotten, changing the private data encryption key is possible and does not prompt for the old key or password. However, this key is not saved in the configuration and cannot be shown/extracted.
Additional note:
With the release of FortiOS v7.6.1, Fortinet improved the private-date-encryption key features. Administrators no longer have to manually enter a 32-digit hexadecimal private-data encryption key. Instead, the administrator simply enabled the command, which generates a random private-date-encryption key.
Starting from v7.6.3, the private data encryption feature will be only supported on devices that contain a Trusted Platform Module (TPM).
Important:
If private-data-encryption needs to be disabled, this will result in the loss of access to previously encrypted backups. Any configuration backups or private data encrypted with the custom master key (stored in the TPM) will no longer be accessible once the system reverts to the default key.
Related articles:
Technical Tip: How to verify the Private Data Encryption Feature
Technical Tip: How to enable private data encryption in HA Cluster
Technical Tip: How to restore a backup configuration File with the private-data encryption feature
Technical Tip: Notification private-data-encryption from FortiManager
Technical Tip: Unable to Enable Private-Data-Encryption Feature on FortiOS v7.6.3
