Microsoft Teams SSL.Anonymous.Ciphers.Negotiation

[Duncan]

Is anyone else getting SSL.Anonymous.Ciphers.Negotiation IPS notification when using Microsoft Teams? I am getting about 20 per hour with 200 staff. Haven't seen it on my PC yet even though I am running teams. The host names are:

worldaz.tr.teams.trafficmanager.net

worldaz.tr.teams.microsoft.com

[awomack]

Yes I am seeing the same

[Yurisk]

Yep, seen as well.

Some more info: https://www.reddit.com/r/fortinet/comments/gtc6k3/what_does_sslanonymousciphersnegotiation_alert/

[Jpicou]

Seeing the same alert on Fortigate 100D and trying to confirm this is not an issue with MS Teams, because of the way MS is encrypting (see below).  As long as TLS1.2 is used this is not an issue, right?.

"Man-in-the-middle attacks on media traffic between two endpoints participating in Teams audio, video, and application sharing, is prevented by using SRTP to encrypt the media stream. Cryptographic keys are negotiated between the two endpoints over a proprietary signaling protocol (Teams Call Signaling protocol) which leverages TLS 1.2 and AES-256 (in GCM mode) encrypted UDP / TCP channel."

https://docs.microsoft.com/en-us/microsoftteams/teams-security-guide