FortiGate TLSv1.3 upgrade

[davbu]

Hello,

I recently was testing the upgrade of TLS1.2 to TLS1.3 VPN SSL settings on a 40F.  I enabled TLS 1.3 support using the following CLI commands:

config vpn ssl setting

set ssl-max-proto-ver tls1-3

set ssl-min-proto-ver tls1-3

end

Now, I am unable to VPN using the FortiClient  v7.0.9.0493.  It should be noted that I am using Azure MFA for 2-factor authentication.

I am guessing it is a incompatibility between the VPN client and the new TLS version. TLS 1.3??  Are there any prerequisites, i.e. certificates, etc. that should be done before enforcing TLS1.3?  Any thoughts and suggestions are welcomed.

[AEK]

Hello Dav

Any error message?

[davbu]

This is the basic error I get when trying:

[kumarh]

Hello,

Kindly check and edit the computer registry to enable TLS 1.3:
Go to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

If 'TLS 1.3' is not displaying as a child path under 'Protocols', create it. 'Right-click' 'Protocols', create 'new key', and name it 'TLS 1.3' as mentioned in following document : https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Windows-10-11-unable-to-connect-to...

[davbu]

I'll have to try that on my personal PC as my enterprise PC locks out editing the registry.

[davbu]

No luck changing the registry settings.  I am receiving error message:  Unable to establish the VPN connection.  The VPN server may be unreachable or your identity certificate is not trusted. (-5)

[RinoBroer]

Why do you want to use TLS 1.3 exclusively? You might also consider using only modern cipher suites.

config vpn ssl settings
set banned-cipher RSA DHE SHA1 SHA256 SHA384 ARIA
end

Do you also have the problem with FortiClient 7.2.5.1053?

[arahman]

Hi please try this article 

https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Windows-10-11-unable-to-connect-to...