Technical Tip: How to enable private-data-encryption feature on a standalone FortiGate

[atahir]

Description

This article describes how to enable the private-data-encryption feature on a standalone FortiGate.

Scope

FortiGate v6.2+.

Solution

The Private Data Encryption feature on FortiGate devices is designed to enhance security by encrypting sensitive configuration data stored on the device. This feature is crucial in scenarios where preventing unauthorized access to sensitive information is essential, even in the event of physical access to the device.

With the Private Data Encryption feature enabled, passwords and private keys used in certificates on the FortiGate are encrypted using a predefined private key. They are encoded when displayed in the CLI and configuration files, ensuring they cannot be decrypted without the private key, and are never displayed in clear text. To restore a system from a configuration file on another FortiGate, the same private key is required.

By default, the Trusted Platform Module (TPM) is disabled. To enable it, set a 32-digit hexadecimal master encryption password, which encrypts sensitive data on the FortiGate using AES-128-CBC. This password is then used by TPM to generate a 2048-bit primary key, which secures the master encryption password through RSA-2048 encryption. The master encryption password protects the data, while the primary key protects the master encryption password.

Note that the TPM module does not encrypt the disk drive of eligible FortiGate devices.

To enable TPM and input the master‑encryption‑password:

config system global

    set private-data-encryption enable

end

Please type your private data encryption key (32 hexadecimal numbers):

********************************

Please re-enter your private data encryption key (32 hexadecimal numbers) again:

********************************

Your private data encryption key is accepted.

Important note:

This is a 32-character user must create and input (hexadecimal = characters a,b,c,d,e,f and digits). This is not a software-generated key and may not contain special characters (execute private-encryption-key sample: this command does not create an example key for use above).

If forgotten, changing the private data encryption key is possible and does not prompt for the old key or password. However, this key is not saved in the configuration and cannot be shown/extracted.

Additional note: With the release of FortiOS v7.6.1, Fortinet improved the private-date-encryption key features. Administrators no longer have to manually enter a 32-digit hexadecimal private-data encryption key. Instead, the administrator simply enabled the command, which generates a random private-date-encryption key. 

Related documents:

How to verify the Private Data Encryption Feature

How to enable private data encryption in HA Cluster

How to restore a backup configuration File with the private-data encryption feature

FortiManager and the private-data-encryption feature

[mimran]

Thanks for sharing the details.