FortiManager - Pushing CLI Configuration Which Doesn't Exist

[Dan_Eng52]

Hi all, 

I hope you can help me. 

I'm having an issue with our FortiManager and a conflict which is preventing us from getting the firewall to a synchronised state. Below is the ssl-ssh-profile and the configuration which it is trying to push, the problem is that this command doesn't exist on the FG CLI. 

Does anyone now how I can remove this CLI configuration? I have tried un-selecting but it automatically add tls-1.1 back into the settings, it's very annoying and although it doesn't stop us from pushing our dynamic policy and other configuration it will never been show synchronized due to this conflict. 

Many thanks, 

Dan. 

[sw2090]

Strange. Accoarding to https://docs.fortinet.com/document/fortigate/7.2.0/cli-reference/319620/config-firewall-ssl-ssh-prof... the option exists even in FOS 7.2.

Hence you didn't post the original error - could it be that it didn't complain about min-allowed-ssl-version not existing but didn't accept your TLS version?

Did you try to roll out with the default tls-v1-1? Did that work?

Did you disable tls versions so they are not available on your FGT?

[Dan_Eng52]

Hey @sw2090, 

Thanks for your response. 

It's very weird, I have tried within FortiManager setting the min-allowed-ssl-version to tls-v1-1 but unfortunately it gave me the same error. It seems as though my problem is that the command doesn't exist in the CLI of my FGT although it's clear from the CLI reference guide that it should be there. 

I'm thinking that there must be something that is required to 'enable' these commands to be displayed within the CLI, but I haven't uncovered this yet. 

Thanks, 
Dan. 

[Dan_Eng52]

I've just tested this on my lab firewall running a similar setup with version 7.2.10 and this command is available: 

However, this isn't the case for my firewalls running 7.4.7 therefore, something must have changed and it either needs to be enabled somehow or it is an issue with this version of firmware perhaps, I'm really not too sure. 

Thanks, 

Dan.