Remediating security vulnerabilities

[mguernsey]

Very new to Fortinet products, so please bear with me.

I'm a government contractor and we've got a few FortiGate 200Ds (firmware version 5.2.9) and a FortiManager 1000D (firmware version 5.2.8) for a project we're still in the process of standing up. As part of this we're using AlienVault to scan hosts for security vulnerabilities and I got reports about our FortiGates and the FortiManager. I've managed to fix all the high priority vulnerabilities on the FortiGates except for one medium, which I think can be resolved with a new certificate that doesn't use the SHA-1 signature algorithm. Most of the fixes were readily available online, and I'm fairly confident I can fix the last one once I get around to it. But the FortiManager is proving to be a giant pain.

I was able to resolve one of the three high findings regarding SSL weak ciphers, which removed 10 ciphers from the list available by telling FortiManager to set enc-algorithm to high. Unfortunately there are 6 weak ciphers still detected:

TLS1_RSA_RC4_128_MD5 TLS1_RSA_RC4_128_MD5 TLS_1_2_RSA_WITH_RC4_128_MD5 TLS_1_2_RSA_WITH_3DES_EDE_CBC_SHATLS_1_2_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_1_2_RSA_WITH_3DES_EDE_CBC_SHA   I've got a month to fix these high severity findings, but none of the documentation I've read or found online has been a lot of help in finding the solution. In addition to the 2 high severity findings there are also 2 medium severity findings regarding the Diffie-Hellman group using a 1024-bit key instead of the recommended 2048-bit, 2 medium severity findings regarding the SHA-1 weak signature algorithm, and 1 medium severity finding regarding FortiManager implementing time stamps.   My google-fu is failing me for now, so if anyone can point me in the right direction I would be really grateful.

[ergotherego]

From what I can see the only supported way to disable those ciphers is to enable FIPS mode, which requires special firmware is very limited in release. 5.0.10 has it, and probably only a few others. Takes 2 years to become FIPS compliant, so 5.4 won't have it for awhile yet.

Since your client is a government entity, I think you will have to downgrade to one of the FIPS compliant version.

If you adjust the httpd-ssl.conf settings manually, they get overwritten at reboot. Probably some way to work-around that, but mucking around inside system files on an appliance is probably a very bad idea.

Edit: Support just told me the latest FIPS compliant version is 5.2.7. Not sure if that is rolled up in the standard image, or you need to request a special one from FortiNet.

[MikePruett]

You enabled strong crypto on the Gate to resolve the issues? I don't have access to my Manager to see if strong crypto even exists for it.

Perhaps place the Manager behind the gate and keep it privately accessible only?

[mguernsey]

FortiManager is already behind god only knows how many firewalls, but the scans are done from inside the network, not outside, and any vulnerability findings either need to have an exemption made (not very likely) or the vulnerability fixed, otherwise the network folks boot your device off the network until such time as you fix it.

I was able to use 'set enc-algorithm high' in the CLI, which changed the cryptographic strength from default (low, I think) to high, removing the availability of 10 of the 16 weak ciphers. Now I just need to remove/disable the last 6 remaining annoyances.