Login and anti repay config

[Leaky5]

I dont do much of out FGs, so just want to check something before appling it.

We have been told to implement 'replay-resitant authentication mechanisms' this by our Security manager, using the commands below

set config system global

set admin-https-ssl-versions tlsv1-2 tlsv2-3

set admin-ssh-v1 disable

I just would like some validation that this is only applicable to logging onto the devices as an admin user and that it does not effect any firewall flows in any way.

I plan to use -

set cfg-save revert

set cfg-revert-timeout 600

To cover any issues when applying

We only use our FGs for firewall type connections.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks

[Toshi_Esumi]

Of course, yes. Otherwise the config items wouldn't start with "admin-https-" and "admin-ssh-". That's a common practice to disable lower SSL encryptions and use SSH v2 only. Also, at least 7.2 or above, those settings are there by default. So if you don't see them under "config sys global", they're already configured that way and even if you executed the command lines, nothing would change in "show".

Check below to see the current setting:

config sys global
show full | grep admin-https-ssl-version
show full | grep admin-ssh-v1

Our 1000F w/ 7.2.9 shows below. I never configured these.

FG1K0Fxxxxxxx-fg1 (global) # show full | grep admin-https-ssl-version
set admin-https-ssl-versions tlsv1-2 tlsv1-3

FG1K0Fxxxxxxx-fg1 (global) # show full | grep admin-ssh-v1
set admin-ssh-v1 disable

Toshi