FortiGates unable to connect to FAZ after upgrade

[dleboeuf]

Hello,

I recently upgraded a customers FAZ-200F from version 6.4.9 to version 7.0.10 and now none of the FortiGates will connect. All of the FortiGates are on version 7.0.12 which looks to be supported by FAZ on 7.0.10 per the matrix.

The FAZ had support expire on it so I cannot contact support at the moment unfortunately which is why I am coming here.

When I run log fortianalyzer test-connectivity on the FortiGate I get 'Failed to get FAZ's status. Invalid error number (0).(0)' which looks like it's pointing to a certificate error. I verified the FGTs and FAZ have matching certificates. I tried importing the local FAZ cert onto a FGT with no luck.

When I run 'diagnose debug app oftpd 255' on the FAZ I get the following output:

2023-12-19 13:43:57 [OFTP_SSL_CTX_dft:1237 10.112.15.50] dft-idx=0 inited=1.
2023-12-19 13:43:57 [__create_ssl_context:1663 10.112.15.50] SSL socket[72] pid[29164] ssl[0x18427b0] SSL_new() success.
2023-12-19 13:43:57 [__SSL_info_callback:299] before SSL initialization
2023-12-19 13:43:57 [__SSL_info_callback:299] before SSL initialization
2023-12-19 13:43:57 [server_sni_cb:1252] server_sni_cb(): sni='0x11e47f0/fortinet-ca2.fortinet.com'
2023-12-19 13:43:57 [server_sni_cb:1266] -- SSL server got SNI: 'fortinet-ca2.fortinet.com', SSL_CTX located: 0x120fda0, idx=0
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS read client hello
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write server hello
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write change cipher spec
2023-12-19 13:43:57 [__SSL_info_callback:299] TLSv1.3 write encrypted extensions
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write certificate request
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write certificate
2023-12-19 13:43:57 [__SSL_info_callback:299] TLSv1.3 write server certificate verify
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write finished
2023-12-19 13:43:57 [__SSL_info_callback:299] TLSv1.3 early data
2023-12-19 13:43:57 [__SSL_info_callback:330] TLSv1.3 early data
2023-12-19 13:43:57 [OFTP_try_accept_SSL_connection:1843 10.112.15.50] SSL accept failed
2023-12-19 13:43:57 [OFTP_ssl_shutdown:1976 10.112.15.50] SSL pid[29164] ssl[0x16e2910] shuting down sockfd[28] ip[10.112.15.50] connected[1]
2023-12-19 13:43:57 [OFTP_ssl_shutdown:1989 10.112.15.50] SSL_shutdown Error. SSL_get_error[1]
2023-12-19 13:43:57 [OFTP_ssl_shutdown:1992] Error error:140E0197:SSL routines:SSL_shutdown:shutdown while in init
2023-12-19 13:43:57 [oftpd_close_session:847 10.112.15.50] Client connection closed. Reason 14(SSL setup failure)

Everything looks to be going okay until this error '2023-12-19 13:43:57 [OFTP_try_accept_SSL_connection:1843 10.112.15.50] SSL accept failed.' 

Does anyone have any tips on what I could check/verify regarding this? I have gone through multiple KBs with no luck. I can't seem to find anything online regarding that OFTP error I am seeing in the deubgs.

Thanks!

[dbu]

Hi @dleboeuf ,

I would focus on the reason of this failure : Reason 14(SSL setup failure). 
Verify the certificates involved and the TLS version on both sides

[dleboeuf]

1. How do I verify which certificates are involved? I checked the CA certs on FAZ and FGT and they both have matching certificates

2.

FAZ:

config system global
set adom-status enable
set ai-disk-quota 10
set enc-algorithm low
set fortirecorder-disk-quota 4096
set hostname "name"
set log-forward-cache-size 4
set oftp-ssl-protocol tlsv1.0
set ssl-protocol tlsv1.3 tlsv1.2 tlsv1.1 tlsv1.0
set timezone 08
set usg enable

FGT:

config log fortianalyzer setting
set status enable
set server "10.112.15.14"
set certificate-verification disable
set enc-algorithm low
set ssl-min-proto-version TLSv1
set upload-option realtime
end

[dleboeuf]

It ended being MTU.

I lowered the FAZ MTU to 1400 and all of my FGTs connected, weird. MTUs have always been set to default before the upgrade so not sure what happened.

[ssteo]

@dleboeuf 

Can you disable enc-algorithm in Fortigate and see the connection able to establish?

Below are the commands:

config log fortianalyzer setting
set enc-algorithm disable

end

[dleboeuf]

I don't have the option to disable it on the FortiGate side.

I have tried setting enc-algorithm to low and it still won't connect. I have gone through every KB I can find and haven't gotten anywhere. 

[dleboeuf · Accepted solution]

It ended being MTU, I didn't see that part in the KB.

I lowered the FAZ MTU to 1400 and all of my FGTs connected, weird. MTUs have always been set to default before the upgrade so not sure what happened.

[dleboeuf]

According to this KB, the 'Failed to get FAZ's status. Invalid error number (0).(0)' error is seen when a certificate is missing on the FortiGate. Here are the CA certificates on my FortiGate:

FortiGate Certificates

Here are the CA certificates on the FAZ:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Getting-error-failed-to-get-faz-s-status-i...

[dleboeuf]

Does having the OFTP certificate set to the following cause issues?

# config system certificate oftp

(oftp)# get
comment : (null)
mode : default

[vraev]

Dear Customer,

Review if the versions are compatible:

https://docs.fortinet.com/document/fortianalyzer/7.4.0/compatibility-with-fortios
Please try to ping with df-bit and 1500 MTU if there is an issue lower it to 1400 or less until the ping is ok. Then change the MTU under the FAZ interface to the new value.

Follow the steps in the following article.
https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-FortiGate-to-FortiAnalyzer-conne...