Adding Fortigate VM eval to FortiManager VM eval

[Great_Dane]

Hi everyone,

I am trying to add a Fortigate VM eval, generated via the FortiCloud account to the FortiManager VM eval, also generated via the FortiCloud account. So, both units are "self-generated" evals. I am not talking about evals obtained through the local supplier. It is not working!!!

From the debug output on FGM, it seems like the FG is not sending any certificate to the FGM while trying to setup communication via FGFM.

This is a debug output from the FGM:

2025-02-11 06:44:29 Use cert idx=0 by peer_ca = 1
2025-02-11 06:44:29 __info_callback,993: role=svr,state=23, TLSv1.3 SSLv3/TLS write certificate
2025-02-11 06:44:29 __info_callback,993: role=svr,state=40, TLSv1.3 TLSv1.3 write server certificate verify
2025-02-11 06:44:29 __info_callback,993: role=svr,state=36, TLSv1.3 SSLv3/TLS write finished
2025-02-11 06:44:29 __info_callback,993: role=svr,state=46, TLSv1.3 TLSv1.3 early data
2025-02-11 06:44:29 __info_callback,993: role=svr,state=46, TLSv1.3 TLSv1.3 early data
2025-02-11 06:44:29 TLSv1.3 write fatal alert: unknown
2025-02-11 06:44:29 fw_proto_ssl.c,1026: TLSv1.3 error
2025-02-11 06:44:29 fw_proto_ssl.c,__get_error,1615, err=167772359, error:0A0000C7:SSL routines::peer did not return a certificate.
2025-02-11 06:44:29 fw_proto_ssl.c,__get_error,1629, ret=-4, error=1, errno=0,Success.
2025-02-11 06:44:29 proxy_session.c,__proxy_session_cleanup, 118:cnt=0, session=0x558f996106bc.

On FG unit I can see the FGM is resetting the connection:

FGFMs: setting session 0x5578e5f67440 exclusive=0
FGFMs: Connect to 10.100.100.20:541, local 10.100.100.21:10514.
FGFMs: set_fgfm_sni SNI<fortinet-ca2.fortinet.com>
FGFMs: Load Cipher [ALL:!RC4:!EXPORT:@STRENGTH]
FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
FGFMs: Set self_initiated = 1
FGFMs: before SSL initialization
FGFMs: CA to broadcast: subject fortinet-subca2001, issuer fortinet-ca2
FGFMs: Broadcast 1 CA subject names to FMG
FGFMs: SSLv3/TLS write client hello
FGFMs: SSLv3/TLS write client hello
FGFMs: SSLv3/TLS read server hello
FGFMs: SSLv3/TLS write change cipher spec
FGFMs: SSLv3/TLS write client hello
FGFMs: SSLv3/TLS write client hello
FGFMs: SSLv3/TLS read server hello
FGFMs: TLSv1.3 read encrypted extensions
FGFMs: SSLv3/TLS read server certificate request
FGFMs: Verified CA certificate 1: (subject: fortinet-subca2001, issuer: fortinet-ca2)
FGFMs: Verified peer certificate 0: (subject: *****, issuer: fortinet-subca2001)
FGFMs: SSLv3/TLS read server certificate
FGFMs: TLSv1.3 read server certificate verify
FGFMs: SSLv3/TLS read finished
FGFMs: SSLv3/TLS write client certificate
FGFMs: SSLv3/TLS write finished
FGFMs: SSL negotiation finished successfully
FGFMs: client:send:
get auth
serialno=*****
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64-KVM
fos_ver=700
minor=6
patch=2
build=3462
branch=3462
maxvdom=2
fg_ip=10.100.100.21
hostname=*****
harddisk=yes
biover=04000002
harddisk_size=32768
logdisk_size=32124
mgmt_mode=normal
enc_flags=0
mgmtip=10.100.100.21
mgmtport=443


FGFMs: [__get_error:1169] error=5, errno=104,Connection reset by peer.
FGFMs: [__get_error:1169] error=5, errno=32,Broken pipe.
FGFMs: SSL Alert read: fatal unknown
FGFMs: Cleanup session 0x5578e5f67440, 10.100.100.20.
FGFMs: Destroy session 0x5578e5f67440, 10.100.100.20.

Both units are running FortiOS v7.6.2.

I have tried also with versions 7.4.5 and FG version 7.2.10. No success!

I have gone through all the documentation and know everything about changes from the >= 7.4.6 and peer certificate SN validation, low encryption algorithms, etc. Nothing worked!!!

I have to mention that adding a production or PAYG FG in Azure works like a charm (even with the custom certificates generated via local PKI). So, my guess is that alongside other limitations of FG VM eval (e.g., maximum of 3 routes, 1 CPU and 2 GB of RAM), you cannot mange this FG VM with FGM. Apparently, this had worked before (at least to other folks on the Internet), but it seems like it does not work anymore.

Anyone have had any luck with this setup?

Thank you!

[lukaseng]

Hey,
Facing exactly same issues and spent too many hours troubleshooting this.
Have you found a solution to this?

[Rub_aprendicia]

Hi, 

No, there is no way.

This only works with version lower than v7.6.2/v7.4.6/v7.2.10,

And, This is the problem, the FortiOS Versions.

from the link:

https://community.fortinet.com/t5/FortiManager/Technical-Tip-Setup-custom-certificate-for-FGFM-proto...

you can see:

    Note: 

     Starting in v7.6.2/v7.4.6/v7.2.10, the fgfm-peercert-withoutsn command is no longer         supported, and FortiManager will always check the FortiGate's certificate for the         FortiGate Serial Number.

You can see that the command that allow register fortigate in fortimanager without certificates is only valid in lower versions: 

"

From v7.2.10/v7.4.6/7.6.2 the above command is not available anymore.

"

 included versions

In summary, you can use this command only until versions 7.2.9, 7.4.5 and 7.6.1

config sys global

     set fgfm-peercert-withoutsn enable

And this command is the key for register Eval VM (kvm) fortigate in Fortimanager Eval VM (kvm).

[lukaseng]

That is so disappointing but thanks for confirming it.

I can not find these version in the support portal for download. Where is it possible to find those?

[Rub_aprendicia]

Finally, i have desisted.

And i am working with FGT 7.4.4 and FMG 7.4.3 for my EVAL LAB.

This is the Versions more nearest to 7.4.5 that i have.

I was working with the FMG 7.6.1, BUT is a full BUG, i dont recommended to you

Good luck with your EVAL LAB,

Ru