FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article provides steps to disable DTLS 1.0 on FortiGate and enforce DTLS 1.2 for SSL VPN connections. Disabling DTLS 1.0 helps mitigate security risks and ensures compliance with modern encryption standards.
Scope
FortiGate.
Solution
To disable DTLS 1.0 and enforce DTLS 1.2 for SSL VPN, configure:
config vpn ssl settings
set dtls-tunnel enable
set dtls-min-proto-ver dtls1-2
end
dtls-tunnel: Indicates if DTLS is enabled.
dtls-max-proto-ver: Maximum supported DTLS version. (by default dtls1-2).
dtls-min-proto-ver: Minimum DTLS version allowed.
This ensures DTLS 1.0 is disabled, and only DTLS 1.2 is allowed.
Note:
If the Client is not supporting DTLS 1.2 or UDP is dropped in transit it will always fallback to TCP TLS.
Update FortiClient versions to ensure compatibility with DTLS 1.2.
By default, DTLS is disabled on FortiClient and may need to be enabled.
