Fortiswitch Upgrade to 7.2.4 Causing SSH issues with SolarWinds

[BingleHopper]

This is a FortiSwitch 248E-FPOE. I have replicated the issue with another switch.  The switches were on 7.2.1 and I tried to upgrade one to 7.2.4.  After I noticed the issue, I upgraded another to 7.2.3 with no issue, and then to 7.2.4 where the issue was there again. 

I can ssh to the device using putty, but SolarWinds cannot anymore (I believe solarwinds ncm uses 'We only do' ssh client). SolarWinds gives an error about not being able to negotiate encryption.

On the switch's logs I see that the negotiation failed due to 'no matching MAC found. Their offer: hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5-none'.

I have 'Strong Cyphers' enabled on the switch, but it was previously enabled on 7.2.1 and 7.2.3 (and I'd prefer to keep it on).  I disabled 'Strong Cyphers' just to test and was met with a different log along the lines of 'no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss'.

Did the defaults change with this update or maybe this could be a bug?  If so, is there any way to manually set the cypher on a standalone switch? 

Solarwinds is on the 2022.4.1 version, which is not quite the latest, but one of the latest. 

Finally, I traced a ssh session through putty just to see what cypher was being agreed upon (remember, putty was working, but not solarwinds.  This is what I got:

[AEK]

Probably 7.2.4 dropped some old cypher methods.

I'd suggest to update SolarWinds, or just update or tune its ssh client and libs if possible.

[BingleHopper]

The problem is that according to this link the cyphers do not change from 2022.4.1 to any of the newer versions.  Kind of wondering if anyone else had the problem or if maybe the fortinet does support the cyphers solarwinds is offering and there is some bug?

Thank you though.

[sfrati]

Not sure my answer is really related to your challenge, but be aware that SHA-1 is deprecated and not authorized by default in 7.4.0+
Since 7.4, FOS has been using OpenSSL 3.0, for which X509 certificates signed using SHA1, for instance, are no longer allowed at security level 1 (default level) and above. There is a workaround for that but this will lower the security level to 0.

[BingleHopper · Accepted solution]

As per a ticket, this is a bug set to be fixed in the 7.4.1 release.  A current work around is to just disable strong-crypto and then reboot or kill the ssh process.

The ticket was resolved a while ago, but since I already logged in, I see no reason to not mark this as a solution.

[DiamondDave]

This work-around does not work.  Will need to do a release update for 7.2.6 to resolve this.

set strong-crypto disable
then reboot

Does not allow ssh from Solarwinds Npm.  Same issue with keys.

[mle2802]

Hi @DiamondDave,

Not sure with FortiSwitch but on FortiGate, there is similar issue after upgrading to 7.2.6, SSH key file corrupted and need to re-generate the key. Do the pcap and see if the key list is empty from server. If that the case, try "execute ssh-regen-keys" to re-generate the key file.

[DiamondDave]

Actually, Solar winds came out with an update that seem to have fixed the issue.

[webbyhead]

Hello

Do you have a Solarwinds Device Template that you can share for this Fortinet Switch and firmware version?