FortiManager - Pushing CLI Configuration Which Doesn't Exist

[Dan_Eng52]

Hi all, 

I hope you can help me. 

I'm having an issue with our FortiManager and a conflict which is preventing us from getting the firewall to a synchronised state. Below is the ssl-ssh-profile and the configuration which it is trying to push, the problem is that this command doesn't exist on the FG CLI. 

Does anyone now how I can remove this CLI configuration? I have tried un-selecting but it automatically add tls-1.1 back into the settings, it's very annoying and although it doesn't stop us from pushing our dynamic policy and other configuration it will never been show synchronized due to this conflict. 

Many thanks, 

Dan. 

[dingjerry_FTNT]

And it's better to provide your installation error message from FMG.

I mean the whole error message.

[sw2090]

accoarding to a statement from taC that I got with annother issue I think you ran into the same problem.

Your ADOM is on 7.6 while your FGT is still on 7.4. FMG provides you all options of 7.6 but does not care for your FGT Version here. I had the same with ISDB Entries. I could select Entries that existed only in 7.2 and cannot be deployed to an FGT that still was on 7.0.

I think the same happens here: min-allowed-ssl-version (or its parameters) is an option coming from 7.6 and due to that does not exist in 7.4.

Accoarding to TAC in my case that is wanted behaviour...

[dingjerry_FTNT]

"I think the same happens here: min-allowed-ssl-version (or its parameters) is an option coming from 7.6 and due to that does not exist in 7.4."

This is not true.

My FGT is running V7.4.5 GA and it does have the "min-allowed-ssl-version" setting.

Meanwhile, the FortiOS 7.4.7 CLI reference guide has it:

https://docs.fortinet.com/document/fortigate/7.4.7/cli-reference/116695140/config-firewall-ssl-ssh-p...

 @Dan_Eng52 ,  you did not share what your SSL SSH Profile settings.  You may share it from your FGT config.

My guess is that the status of FTPS is disabled.  This might be why you couldn't configure the "min-allowed-ssl-version" setting.

You may also log into your FGT directly and check whether it has that setting via CLI.

[Dan_Eng52]

Hi @dingjerry_FTNT 

I hope you're well. 

Please see below, in the CLI I do not have the set min-allowed-ssl-version but I do see that it is in the CLI reference document that you provided for 7.4.7 which is odd. 

Is this something that has to be enabled in order for these commands to be listed within the CLI? I tried to have a look, but I couldn't see an explicit 'enable' command or similar to do so. 

Let me know if you want to see any other settings within my ssl-ssh-profile in order to confirm. 

Thanks, 

Dan. 

[dingjerry_FTNT]

Please show the whole configuration of "Corporate-Full-SSL-Inspection" either in CLI or in GUI.

This is weird. The following is from my FGT 7.4.5:

(ftps) # set ?
*ports Ports to use for scanning (1 - 65535, default = 443).
status Configure protocol inspection status.
client-certificate Action based on received client certificate.
unsupported-ssl-version Action based on the SSL version used being unsupported.
unsupported-ssl-cipher Action based on the SSL cipher used being unsupported.
unsupported-ssl-negotiation Action based on the SSL negotiation used being unsupported.
expired-server-cert Action based on server certificate is expired.
revoked-server-cert Action based on server certificate is revoked.
untrusted-server-cert Action based on server certificate is not issued by a trusted CA.
cert-validation-timeout Action based on certificate validation timeout.
cert-validation-failure Action based on certificate validation failure.
min-allowed-ssl-version Minimum SSL version to be allowed.

You can see the "port" setting is with *, which means it is mandatory.

[Dan_Eng52]

Hey @dingjerry_FTNT, 

Thanks for your response. 

Please see snippet below showing show the configuration of my 'Corporate-Full-SSL-Inspection' profile in the GUI. It's rather weird, I cannot find a way to get those options to be displayed on any of my FGT's running version 7.4.7. At the moment, I don't have any firewalls running any earlier firmware so would have spin up and lab and test. 

It could be that there is an option somewhere that enables these options, but I have not uncovered this yet. Do you know if this is something that requires 'enabling' or should those commands be available without any further input? 

Thanks, 

Dan. 

[Dan_Eng52]

Hi @dingjerry_FTNT, 

I have a lab firewall that is running a similar full SSL setup with 7.2.10 installed, when running the same commands in the CLI, I can see I have the min-allowed-ssl-version available: 

Not sure why I cannot see this on my firewalls running 7.4.7. 

Thanks, 

Dan. 

[dingjerry_FTNT]

Hi Dan,

I found the reason.  In your profile, you have enabled the "Inspect all ports" option. 

When this option is enabled, in 7.4, some settings, including the "min-allowed-ssl-version" setting, will not be available.

Please disable the "Inspect all ports" option on FGT or enable it in FMG; it should fix your issue.

[Dan_Eng52]

Hey @dingjerry_FTNT, 

I can confirm this has allowed this option to be displayed and therefore installed via FortiManager however, I now have an issue with config SSL: 

When checking in the CLI, in the config SSL settings within the ssl-ssh-profile the set min-allowed-tls-version isn't displayed so it is still displaying a conflict and install error in FortiManager. 

Also, I would like to inspect all ports this is a requirement for us so by disabling this it is allowing me to install via FortiManager but it means we don't have full inspection on all ports enabled. 

Would like to hear your thoughts on what I can do to perhaps keep the full inspection on all ports and have my FGT syncronized with FMG. 

Perhaps this can only happen with a FortiManager release? 

Thanks, 

Dan. 

[dingjerry_FTNT]

Hi Dan,

1) "When checking in the CLI, in the config SSL settings within the ssl-ssh-profile the set min-allowed-tls-version isn't displayed so it is still displaying a conflict and install error in FortiManager. "

Not sure what you are talking about.  You need to provide all the outputs in CLI with what you were seeing.

2) You may check whether the SSL-SSH profile (Corporate-Full-SSL-Inspection) has the "Inspect all ports" option enabled or not in FMG:

If it is enabled but FMG still pushes the "min-allowed-tls-version" setting, it is an FMG bug.