- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FortiGate TLSv1.3 upgrade
Hello,
I recently was testing the upgrade of TLS1.2 to TLS1.3 VPN SSL settings on a 40F. I enabled TLS 1.3 support using the following CLI commands:
config vpn ssl setting
set ssl-max-proto-ver tls1-3
set ssl-min-proto-ver tls1-3
end
Now, I am unable to VPN using the FortiClient v7.0.9.0493. It should be noted that I am using Azure MFA for 2-factor authentication.
I am guessing it is a incompatibility between the VPN client and the new TLS version. TLS 1.3?? Are there any prerequisites, i.e. certificates, etc. that should be done before enforcing TLS1.3? Any thoughts and suggestions are welcomed.
- Labels:
-
FortiClient
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Dav
Any error message?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is the basic error I get when trying:
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Kindly check and edit the computer registry to enable TLS 1.3:
Go to \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols
If 'TLS 1.3' is not displaying as a child path under 'Protocols', create it. 'Right-click' 'Protocols', create 'new key', and name it 'TLS 1.3' as mentioned in following document : https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Windows-10-11-unable-to-connect-to...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'll have to try that on my personal PC as my enterprise PC locks out editing the registry.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No luck changing the registry settings. I am receiving error message: Unable to establish the VPN connection. The VPN server may be unreachable or your identity certificate is not trusted. (-5)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why do you want to use TLS 1.3 exclusively? You might also consider using only modern cipher suites.
config vpn ssl settings
set banned-cipher RSA DHE SHA1 SHA256 SHA384 ARIA
end
Do you also have the problem with FortiClient 7.2.5.1053?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi please try this article
