Disable hmac-sha1-96 on fortigate 4.3.16

[markmcgloin]

We have strong-crypto enabled on all our fortigates but hmac-sha1-96 is allowed and our CIO office want that disabled

Is there a way to do this with strong-crypto enabled?

If not, how can I configure the MAC and encryption ciphers I need on our fortigates. For mac, I only want hmac-sha1

[FortiRack_Eric]

First of all, upgrade to 4.3.18

Secondly,  for what do you want to enable /disable that? Access to the unit? SSL-VPN, load-balancers etc?

[markmcgloin]

I want it for ssl and ssh access to the fortigate.

Why will upgrading to 4.3.18 make a difference. I do not want to update all our fortigates unless there is a real reason related to the question I asked

thanks

[FortiRack_Eric]

You should upgrade to 4.3.18 as changes in the HTTPS protocol require that for a.o. SSL-VPN.

Furthermore it is good practice to regularly update the firmware. But please read the release notes. Also check for known issues.

Another thing is that 4.3.x is officially not supported anymore on units that can run 5.x firmware.

[markmcgloin]

Can someone answer my original question please. I have posted it below again. If the solution requires an upgrade, then fair enough but would appreciate an explanation in context of solution. thanks

We have strong-crypto enabled on all our fortigates but hmac-sha1-96 is allowed and our CIO office want that disabled   Is there a way to do this with strong-crypto enabled? If not, how can I configure the MAC and encryption ciphers I need on our fortigates. For mac, I only want hmac-sha1