Troubleshooting Tip : 'no shared cipher' error in an SSL VPN

pdelapena · ‎06-20-2024

Description

This article describes how to troubleshoot an issue where users are not able to connect to an SSL VPN as the FortiGate may have banned all the cipher suites supported by an SSL VPN client.

Scope

FortiGate.

Solution

FortiGate has options to control the TLS versions and cipher suites used for SSL-VPN. If there are changes in supported TLS versions and cipher suites, there needs to be at least one cipher that matches between the SSL VPN client and FortiGate.

In this scenario, the following SSL VPN settings were configured and the usage of RSA, ECDHE, and STATIC cipher suites for SSL VPN have been banned (all other settings are default):

config vpn ssl settings

set ssl-max-proto-ver tls1-3
set ssl-min-proto-ver tls1-2
set banned-cipher RSA ECDHE STATIC
set ciphersuite TLS-AES-128-GCM-SHA256 TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256
set algorithm high

end

The SSL VPN user trying to connect to the SSL VPN via FortiClient got the following error code (-5029):

-5029 error.JPG

While running the SSL VPN debug and simulating the issue, the following debug output can be observed indicating 'no shared cipher':

FGT# diag debug app sslvpn -1
FGT# diag debug enable

[1956:root:19d]allocSSLConn:310 sconn 0x7f257e654800 (0:root)
[1956:root:19d]SSL state:before SSL initialization (10.0.0.16)
[1956:root:19d]SSL state:before SSL initialization (10.0.0.16)
[1956:root:19d]no SNI received
[1956:root:19d]client cert requirement: no
[1956:root:19d]SSL state:fatal handshake failure (10.0.0.16)
[1956:root:19d]SSL state:error:(null)(10.0.0.16)
[1956:root:19d]SSL_accept failed, 1:no shared cipher
[1956:root:19d]Destroy sconn 0x7f257e654800, connSize=0. (root)

If there are only certain devices affected by this issue, initial checking can be done on the user side by identifying what TLS versions are enabled and what ciphers are being offered. This KB article: Technical Tip: Checking the TLS cipher suites offered by Windows device can be followed to determine the TLS cipher suites offered by Windows devices.

Enumerated above are the ciphers offered by the SSL VPN client and only TLS v1.1 and v1.2 are enabled in Internet properties.

Doing an NMAP scan in the FortiGate to see what ciphers are supported for SSL VPN shows the following output below.

The minimum TLS version supported is TLS v1.2 and the maximum is TLS v1.3.

Comparing the ciphers offered by the SSL VPN client and what is supported by the FortiGate, there is no cipher shared between the client and server. TLS v1.3 is also disabled on the client side while TLS v1.1 is not supported by FortiGate.

To solve this issue, remove all of the cipher suites that are banned or slowly add them one by one in the FortiGate SSL VPN settings until there is a match.