Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
dleboeuf
New Contributor II

FortiGates unable to connect to FAZ after upgrade

Hello,

 

I recently upgraded a customers FAZ-200F from version 6.4.9 to version 7.0.10 and now none of the FortiGates will connect. All of the FortiGates are on version 7.0.12 which looks to be supported by FAZ on 7.0.10 per the matrix.

 

The FAZ had support expire on it so I cannot contact support at the moment unfortunately which is why I am coming here.

 

When I run log fortianalyzer test-connectivity on the FortiGate I get 'Failed to get FAZ's status. Invalid error number (0).(0)' which looks like it's pointing to a certificate error. I verified the FGTs and FAZ have matching certificates. I tried importing the local FAZ cert onto a FGT with no luck.

 

When I run 'diagnose debug app oftpd 255' on the FAZ I get the following output:

2023-12-19 13:43:57 [OFTP_SSL_CTX_dft:1237 10.112.15.50] dft-idx=0 inited=1.
2023-12-19 13:43:57 [__create_ssl_context:1663 10.112.15.50] SSL socket[72] pid[29164] ssl[0x18427b0] SSL_new() success.
2023-12-19 13:43:57 [__SSL_info_callback:299] before SSL initialization
2023-12-19 13:43:57 [__SSL_info_callback:299] before SSL initialization
2023-12-19 13:43:57 [server_sni_cb:1252] server_sni_cb(): sni='0x11e47f0/fortinet-ca2.fortinet.com'
2023-12-19 13:43:57 [server_sni_cb:1266] -- SSL server got SNI: 'fortinet-ca2.fortinet.com', SSL_CTX located: 0x120fda0, idx=0
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS read client hello
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write server hello
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write change cipher spec
2023-12-19 13:43:57 [__SSL_info_callback:299] TLSv1.3 write encrypted extensions
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write certificate request
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write certificate
2023-12-19 13:43:57 [__SSL_info_callback:299] TLSv1.3 write server certificate verify
2023-12-19 13:43:57 [__SSL_info_callback:299] SSLv3/TLS write finished
2023-12-19 13:43:57 [__SSL_info_callback:299] TLSv1.3 early data
2023-12-19 13:43:57 [__SSL_info_callback:330] TLSv1.3 early data
2023-12-19 13:43:57 [OFTP_try_accept_SSL_connection:1843 10.112.15.50] SSL accept failed
2023-12-19 13:43:57 [OFTP_ssl_shutdown:1976 10.112.15.50] SSL pid[29164] ssl[0x16e2910] shuting down sockfd[28] ip[10.112.15.50] connected[1]
2023-12-19 13:43:57 [OFTP_ssl_shutdown:1989 10.112.15.50] SSL_shutdown Error. SSL_get_error[1]
2023-12-19 13:43:57 [OFTP_ssl_shutdown:1992] Error error:140E0197:SSL routines:SSL_shutdown:shutdown while in init
2023-12-19 13:43:57 [oftpd_close_session:847 10.112.15.50] Client connection closed. Reason 14(SSL setup failure)

 

Everything looks to be going okay until this error '2023-12-19 13:43:57 [OFTP_try_accept_SSL_connection:1843 10.112.15.50] SSL accept failed.' 

 

Does anyone have any tips on what I could check/verify regarding this? I have gone through multiple KBs with no luck. I can't seem to find anything online regarding that OFTP error I am seeing in the deubgs.

 

Thanks!

1 Solution
dleboeuf
New Contributor II

It ended being MTU, I didn't see that part in the KB.

 

I lowered the FAZ MTU to 1400 and all of my FGTs connected, weird. MTUs have always been set to default before the upgrade so not sure what happened.

View solution in original post

10 REPLIES 10
dbu
Staff
Staff

Hi @dleboeuf ,

I would focus on the reason of this failure : Reason 14(SSL setup failure). 
Verify the certificates involved and the TLS version on both sides

 

Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
dleboeuf
New Contributor II

1. How do I verify which certificates are involved? I checked the CA certs on FAZ and FGT and they both have matching certificates

2.

FAZ:

config system global
set adom-status enable
set ai-disk-quota 10
set enc-algorithm low
set fortirecorder-disk-quota 4096
set hostname "name"
set log-forward-cache-size 4
set oftp-ssl-protocol tlsv1.0
set ssl-protocol tlsv1.3 tlsv1.2 tlsv1.1 tlsv1.0
set timezone 08
set usg enable

 

FGT:

config log fortianalyzer setting
set status enable
set server "10.112.15.14"
set certificate-verification disable
set enc-algorithm low
set ssl-min-proto-version TLSv1
set upload-option realtime
end

 

dleboeuf
New Contributor II

It ended being MTU.

 

I lowered the FAZ MTU to 1400 and all of my FGTs connected, weird. MTUs have always been set to default before the upgrade so not sure what happened.

ssteo
Staff
Staff

@dleboeuf 

Can you disable enc-algorithm in Fortigate and see the connection able to establish?

Below are the commands:

config log fortianalyzer setting
set enc-algorithm disable

end

dleboeuf
New Contributor II

I don't have the option to disable it on the FortiGate side.

 

I have tried setting enc-algorithm to low and it still won't connect. I have gone through every KB I can find and haven't gotten anywhere. 

dleboeuf
New Contributor II

It ended being MTU, I didn't see that part in the KB.

 

I lowered the FAZ MTU to 1400 and all of my FGTs connected, weird. MTUs have always been set to default before the upgrade so not sure what happened.

dleboeuf
New Contributor II

According to this KB, the 'Failed to get FAZ's status. Invalid error number (0).(0)' error is seen when a certificate is missing on the FortiGate. Here are the CA certificates on my FortiGate:

FortiGate CertificatesFortiGate Certificates

 

Here are the CA certificates on the FAZ:

2023-12-20 09_21_17-Window.png

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Getting-error-failed-to-get-faz-s-status-i...

dleboeuf
New Contributor II

Does having the OFTP certificate set to the following cause issues?

 

# config system certificate oftp

(oftp)# get
comment : (null)
mode : default

vraev
Staff
Staff

Dear Customer,

Review if the versions are compatible:

https://docs.fortinet.com/document/fortianalyzer/7.4.0/compatibility-with-fortios
Please try to ping with df-bit and 1500 MTU if there is an issue lower it to 1400 or less until the ping is ok. Then change the MTU under the FAZ interface to the new value.

Follow the steps in the following article.
https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-FortiGate-to-FortiAnalyzer-conne...

V.R.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors