How to chnage tls version for web mode ssl VPN?

[nanoart]

I am testing  web mode ssl VPN on Fortigate 7.4.3 build 2573 (FGVM64-FW-7.04-2573) with Evaluation License,  and noticed that only TLSv1.0 enabled.

```

SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 enabled
TLSv1.1 disabled
TLSv1.2 disabled
TLSv1.3 disabled

```

No wonder that the Chrome browser reported `ERR_SSL_VERSION_OR_CIPHER_MISMATCH`.

Then I tried to change tls version with CLI,

config vpn ssl settings

set ssl-min-proto-ver tls1-2

But  I got the following error,

command parse error before 'ssl-min-proto-ver'
Command fail. Return code -61

Anyone can help?

[ozkanaltas]

Hello @nanoart ,

The eval mode has a limitation about the TLS version. Because of that, you can't increase the TLS version in Eval mode.  You can review this document about the eval mode limitation. 

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/441460/permanent-trial-mode-...!

[nanoart]

@ozkanaltas , thank you very much for the reply.

If it is true, then this limitation is silly I am afraid. I wish Fortinet can set tls1.2 as the default.

[ndumaj]

Hello Nanoart,

Well, it can easily verify by nmap:
nmap --script ssl-enum-ciphers -p 443 <IP>

output...
PORT STATE SERVICE
443/tcp open https
| ssl-enum-ciphers:
| TLSv1.2:

BR

[nanoart]

@ndumaj Thanks.

I already used `sslscan` to check the server and found it only served `tls1.0`. 

I think `nmap` just does the same thing.

[ndumaj]

Hello nanoart,

Yeap, if you have a FGT with permanent lic you can see the output difference.

BR

[nanoart]

In that case, I am very disappointed that FGT still uses `tls1.0` as the default in Year 2024!

@ndumaj I just noticed you are a `Staff`, can you please let your boss know this complaint?

Many Thanks.

[ndumaj]

Hello @nanoart,
Thank you for your update,

I double-checked on my LAB and the default ssl vpn setting is:
set ssl-max-proto-ver tls1-3
set ssl-min-proto-ver tls1-2

On EVAL lic you are facing some restrictions that usually are not presented on permanent lic mode.

BR

[nanoart]

Hi @ndumaj 

I do understand the EVAL license has some limitations, but this one, `tls1.0`, makes the evaluation useless nowadays. I had to dig out the `Internet Explorer` from my antique Windows 2012 server R2 to do the test.

[ndumaj]

Hello @nanoart 
That is true, I'll report this internally to the respective team.
Meanwhile, please reach your SE representatives if they can help you in this POC.

BR