TLSv1.3 is now an approved standard how will D & E series 5.6 Fortigates deal with it?

[NapaCab]

Now that the standard has been ratified, how will the Fortigate D (CP8) and Fortigate E series (CP9) deal with TLSv1.3?

[Wayne11]

Hi boneyard

Nope, can't reach Mozilla, packet capture shows a RST ACK packet sent from the FG to the Client.

I'ts definitely TLS1.3, the policy has no security profiles now, only Deep Inspection, as soon as we switch the policy to certificate inspection everything works normal.

I'll open a support ticket, thanks for pointing me to the right direction.

[Wayne11]

Ok, just to keep everyone informed, it's a well known "Internal" Forti bug with the famous number 0531575. It will be fixed in 6.0.5.

I still don't get it why they can't publish their "internal" bug data base to us customers, we could safe a lot of time and money and would not always open a support ticket for well known bugs.

[boneyard]

did you get any more details about the "issue" which is fixed in 6.0.5? because as mentioned in general TLS1.3 websites work for me in 5.6 and 6.0 in proxy mode.

[Wayne11]

They just told me it has to do with a missorder of the cipher in some TLS pages, it's not just a TLS 1.3 problem.

Sorry, that's all I can tell, we had to create already 20 Deep Scan exclusions for such pages.