Technical Tip: How to verify if static Cipher suites are disabled

[RBA]

Description	This article describes how to verify if static cipher suites are disabled on the FortiGate.
Scope	FortiGate.
Solution	A security audit would need static ciphers to be disabled on the FortiGate for compliance purposes. Encryption level can be controlled as defined in the document: FortiGate encryption algorithm cipher suites A few of the most common static ciphers are listed below. Static RSA: TLS_RSA_WITH_NULL_MD5 TLS_RSA_WITH_NULL_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_IDEA_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 Static DH: TLS_DH_DSS_WITH_DES_CBC_SHA TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA TLS_DH_RSA_WITH_DES_CBC_SHA TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA Static ECDH: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA TLS_ECDH_RSA_WITH_AES_256_CBC_SHA TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA To confirm if the Ciphers are disabled, NMAP ( nmap -p 443 --script ssl-enum-ciphers xx.xx.xx.xx ) can be initiated. Screenshots below show the cipher results when 'ssl-static-key-ciphers' are enabled and disabled (Illustration with RSA).  config system global     set ssl-static-key-ciphers enable end config system global     set ssl-static-key-ciphers disable end Vulnerability Assessment would still show static Ciphers in the report even though it is disabled under the global config. Virtual-Server and SSL VPN config would also have to be modified to disable static Ciphers. config vpn ssl settings     set ssl-min-proto-ver tls1-2     set banned-cipher SHA1 SHA256 SHA384 end Results with the banned cipher RSA: config vpn ssl settings     set ssl-min-proto-ver tls1-2     set banned-cipher RSA end Static Ciphers under VIP/Virtual servers can be controlled with the following config: config firewall vip     edit "VIP"         set ssl-dh-bits 2048         set ssl-algorithm high         set ssl-pfs require         set ssl-min-version tls-1.2         set ssl-max-version tls-1.3     next end SSL-Algo can be set to custom, and specific ciphers can be selected.