SSL renegotiation

[JTMarcure]

Hi, I have a FortiWiFi 60 C v4.0,build0672,130904 (MR3 Patch 15) and I' m trying to get it to pass PCI intrusion detection. It has been suggested that I disable TLS renegotiation but how? The What' s new FortiOS 4.0 MR3 documnet says the following to disable config firewall vip set ssl-client-renegotiation {allow | deny} end The problem is that I get an Unknown action 0 error when I try the command. Any suggestions?

[ShrewLWD]

Mmm, kk. I did re-read your last note, and saw it was 10443 failing, which is SSL VPN. Is that something you are offering employees? If so; 1) You will have to purchase and install a valid SSL Certificate, to pass all the Self-Signed fails. 2) Turn Strong Crypto on; config system global set strong-crypto enable end 4) What is running on 8080? Did you redirect the web page login for the firewall to 8080? By default, a Fortinet doesn' t have anything listening on 8080. 5) Have you allowed the firewall website to be reached unrestricted? If you go to System -Admin --Administrators Are there any Trusted Hosts listed, or is it just 0.0.0.0/0.0.0.0 If it is 0.0.0.0, you may want to consider locking that down to a very small subset of known IP ranges (e.g. the internal range, and possibly one public, if that public IP is a remote management location).

[JTMarcure]

Port 10443 is where the Fortinet portal is. Our District Managers use the portal to gain access to applications behind the firewall. Port 8080 is for remote admin and is IP restricted to only 3 ip addresses. We are not as concerned with the certificate failures as the PCI auditors said it was okay. My big problem is with the TLS Session Renegotiation Vulnerability. The PCI auditors said it must be solved.

[ShrewLWD]

Hmm, we must be missing something simple. You are not doing Offload/loadbalancing, could you have a VOIP profile enabled for inbound? http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/Security.008.23.html I don' t recall that CLi (set ssl-client-renegotiation) being used anywhere else.

[JTMarcure]

We do not have any VOIP setup for our stores.

[ShrewLWD]

Unfortunately, this may be something you will need to call Fortinet TAC. Their SSL VPN for 4.0MR3 here http://docs-legacy.fortinet.com/fgt/handbook/40mr3/fortigate-sslvpn-40-mr3.pdf specifically calls this issue out on page 34; SSL offloading Configuring SSL offloading that allows or denies client renegotiation, is configured in the CLI. This feature helps to resolve the issues that affect all SSL and TLS servers that support renegotiation, identified by the Common Vulnerabilities and Exposures system in CVE-2009-3555. The IETF is currently working on a TLS protocol change that will permanently resolve the issue. The SSL offloading renegotiation feature is considered a workaround until the IETF permanently resolves the issue. The CLI command is ssl-client-renegotiation and is found in config firewall vip command. I built up a full SSLVPN on a 60C, 4.0MR3p15, and cannot enable that setting. Technically, they are missing a line between config firewall VIP and set ssl... You need to select an already created VIP profile, but even after I built one and assigned it, I was still not able to turn that feature on.

[Muahammed]

Regarding Vulnerability Assessment I have 300c version 5.2.11 How Can I FIX pls advice me

1,Untrusted TLS/SSL server X.509 certificate (tls-untrusted-ca)

2,Nameserver Processes Recursive Queries (dns-processes-recursive-queries)

3,TLS/SSL Birthday attacks on 64-bit block ciphers (SWEET32) (ssl-cve-2016-2183-sweet32)

Thank you