| Description | This article describes how to prove transport layer security version 1.1 is already disabled in FortiGate administrative access using Wireshark. |
| Scope | FortiGate. |
| Solution |
Capture the packet by filtering source ip open the connection to test TLS 1.1, command as below:
# diagnose sniffer packet any "host <source ip> and port 443" 6 0
<source ip> is the IP address that tries to connect to the FortiGate using service port number tcp-443(https).
After capturing the packet, convert the file into .pcap format and open using Wireshark.
It is possible to filter TLS version by using 'tls.record.version == 0x0302' to observe the packet. For example, SSL handshakes from client have initiated TLSv1.1 but it has been rejected with the description 'Handshake Failure' as shown in the screenshot below:
 |
