Help
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
strongX509
New Contributor III

Created on ‎02-22-2024 08:47 AM

IPsec IKEv2: No CA certificate chain sent anymore after upgrade to FortiOS v7.4.3

The send-cert-chain attribute set to enable by default in the vpn ipsec phase1 configuration does not cause the CA certificate chain (unnecessary Root CA certificate plus Issuing SubCA certificate) to be included anymore in the IKE_AUTH response by the FortiGate 100F VPN gateway after upgrading to FortiOS v7.4.3. Before the upgrade everything was working fine. Is this an unintended regression introduced by the firmware upgrade?

Labels:
747
0 Kudos
3 REPLIES 3
strongX509
New Contributor III

Created on ‎02-23-2024 12:32 AM

We upgraded from FortiOS 7.4.1 so the send-cert-chain bug could already have been introduced with version 7.4.2.

671
0 Kudos
strongX509
New Contributor III

Created on ‎02-28-2024 12:59 PM

No reaction at all from Fortinet on the apparent send-cert-chain bug?

569
0 Kudos
smaruvala
Staff
Staff

Created on ‎02-28-2024 10:14 PM

Hi,

 

- Have you tried to take ike debug for the IPSEC negotiation along with the debug for fnbamd process as well? 

- I have not heard of a reported issue regarding this. Collecting the debugs will help us if we can see any issues with the negosiation.

 

Regards,

Shiva

554
0 Kudos
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors
View all
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2024 Fortinet, Inc. All Rights Reserved.