Fortinet Community

ethomollari · ‎11-01-2022

Description

This article lists the SSH and TLS ciphers supported by FNAC appliances and explains how to retrieve them.

Scope

FortiNAC 8.8.x, 9.x.

Solution

To retrieve the list of ciphers used by FortiNAC, use the nmap tool in Linux distributions with the FortiNAC management IP.

To retrieve a list of supported SSH Ciphers, run the following command in the CLI:

# nmap -p22 -n -sV --script ssh2-enum-algos 192.168.200.200

To retrieve a list of supported TLS/SSL Ciphers, run the following command in the CLI:

# nmap --script ssl-enum-ciphers -p 8443 192.168.40.110

Starting Nmap 7.40 ( https://nmap.org ) at 2021-08-10 20:02 CEST
Stats: 0:00:00 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 100.00% done; ETC: 20:02 (0:00:00 remaining)
Nmap scan report for fnac-latest.forti.lab (192.168.40.110)
Host is up (0.000058s latency).
PORT STATE SERVICE
8443/tcp open https-alt
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| compressors:
| NULL
| cipher preference: client
|_ least strength: A

Fortinet Community

Technical Tip: Retrieving a list of SSH and TLS/SSL Ciphers supported by FortiNAC appliances