Technical Tip: How to remove cipher suites other t...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 283140

Description

This article describes how to control TLS1.2 cipher suites for HTTPS administrative access.

Scope

FortiGate v7.2v and v7.4.1.

Solution

By default, when strong-crypto is enabled, the cipher suites are listed below:

To disable the following cipher suites and keep the GCM cipher suites (TLS1.2):

AES256-SHA256
ECDHE-RSA-AES256-SHA384
AES128-SHA256
ECDHE-RSA-AES128-SHA256

Use the following commands to keep the GCM cipher suites (TLS1.2):

config system global

set admin-https-ssl-banned-ciphers SHA256 SHA384

end

After the changes, run the TLS scan and the following are the available cipher suites:

562

Contributors

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: How to remove cipher suites other than GCM cipher suites (TLS1.2)