|
To resolve the FortiManager tunnel issue with third-party certificates on FortiGate (this issue was reported under FortiGate HA environment on FortOS v7.4.8 and fixed on v7.4.9), follow these steps:
- Generate a third-party CA certificate and import it to FortiGate and FortiManager.
- Configure FortiGate to use the third-party local certificate.
- Configure FortiManager to use the third-party CA certificate.
- Verify the FortiManager tunnel session is established successfully.
Here are the detailed steps:
- Generate a third-party CA certificate using OpenSSL:
- Create an environment file for the certificate:
config file name : ha_cert_ext.cnf
------------------------------------------------------------
keyUsage=critical,digitalSignature
authorityKeyIdentifier=keyid, issuer:always
subjectKeyIdentifier=hash
basicConstraints=critical,CA:FALSE
# Subject Alternative Names (SANs)
subjectAltName = '@alt_names'
# Remove ' ' value for subjectAltName in real configuration setting.
[alt_names]
DNS.1 = FGT61FTK21001234 # FortiGate #1 serial
DNS.2 = FGT61FTK21001235 # FortiGate #2 serial
------------------------------------------------------------
- Generate a third-party certificate:
openssl genrsa -out myCA.key 4096
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 3650 -out myCA.crt
-
Generate a certificate signing request (CSR) for FortiGate:
openssl genrsa -out ha_shared.key 2048
openssl req -new -key ha_shared.key -out ha_shared.csr
-
Sign the CSR with the third-party CA certificate:
openssl x509 -req -in ha_shared.csr -CA haCA.crt -CAkey haCA.key -CAcreateserial \
-out ha_shared.crt -days 825 -sha256 -extfile ha_cert_ext.cnf
-
Check SAN value:
openssl x509 -in ha_shared.crt -noout -text | grep -A2 "Subject Alternative Name"
-
Import the third-party CA certificate and the signed certificate to FortiGate and FortiManager.
- FortiGate: System -> Certificates -> Import ha_shared.crt, haCA.crt.
- FortiManager: System -> Certificates -> Import haCA.crt.
FortiManager also implicitly trusts the CA that signs Fortinet_Factory certificates as long as the following default setting is not set to 'enable', FortiManager will only trust whatever is specified in 'set fgfm-ca-cert'.
config system global
set fgfm-cert-exclusive disable (Keep default setting)
end
-
Apply the third-party certificate for establishing the FGFM tunnel session:
config system central-management
set local-cert ha_shared
end
config system global
set fgfm-ca-cert haCA
end
-
Verify the FortiManager tunnel session is established successfully.
|
