Fortiswitch Upgrade to 7.2.4 Causing SSH issues with SolarWinds
This is a FortiSwitch 248E-FPOE. I have replicated the issue with another switch. The switches were on 7.2.1 and I tried to upgrade one to 7.2.4. After I noticed the issue, I upgraded another to 7.2.3 with no issue, and then to 7.2.4 where the issue was there again.
I can ssh to the device using putty, but SolarWinds cannot anymore (I believe solarwinds ncm uses 'We only do' ssh client). SolarWinds gives an error about not being able to negotiate encryption.
On the switch's logs I see that the negotiation failed due to 'no matching MAC found. Their offer: hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5-none'.
I have 'Strong Cyphers' enabled on the switch, but it was previously enabled on 7.2.1 and 7.2.3 (and I'd prefer to keep it on). I disabled 'Strong Cyphers' just to test and was met with a different log along the lines of 'no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss'.
Did the defaults change with this update or maybe this could be a bug? If so, is there any way to manually set the cypher on a standalone switch?
Solarwinds is on the 2022.4.1 version, which is not quite the latest, but one of the latest.
Finally, I traced a ssh session through putty just to see what cypher was being agreed upon (remember, putty was working, but not solarwinds. This is what I got:
The problem is that according to this link the cyphers do not change from 2022.4.1 to any of the newer versions. Kind of wondering if anyone else had the problem or if maybe the fortinet does support the cyphers solarwinds is offering and there is some bug?
Not sure my answer is really related to your challenge, but be aware that SHA-1 is deprecated and not authorized by default in 7.4.0+ Since 7.4, FOS has been using OpenSSL 3.0, for which X509 certificates signed using SHA1, for instance, are no longer allowed at security level 1 (default level) and above. There is a workaround for that but this will lower the security level to 0.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.