Technical Tip: How to remove cipher suites other than GCM cipher suites (TLS1.2)

[btey]

Description	This article describes how to control TLS1.2 cipher suites for HTTPS administrative access.
Scope	FortiGate v7.2v and v7.4.1.
Solution	By default, when strong-crypto is enabled, the cipher suites are listed below: To disable the following cipher suites and keep the GCM cipher suites (TLS1.2): AES256-SHA256 ECDHE-RSA-AES256-SHA384 AES128-SHA256 ECDHE-RSA-AES128-SHA256 Use the following commands to keep the GCM cipher suites (TLS1.2): config system global     set admin-https-ssl-banned-ciphers SHA256 SHA384 end After the changes, run the TLS scan and the following are the available cipher suites: For more details on the cipher suite, see Technical Tip: Understanding the cipher suite 1.2 supported by Fortinet devices.