There has been a lot of recent discussion about cipher updates and the need for Solarwinds to update them. In our experience this has been specifically evident when attempting to backup the config of Fortinet devices running on FortiOS 7 and newer.
Essentially the bottom line is that the Fortinets were rejecting the connection due to insecure ciphers in use by Solarwinds and NCM would just show 'connection refused'.
You could run a trace: https://solarwindscore.my.site.com/SuccessCenter/s/article/Generate-session-trace-logs?language=en_US or you could dig into the logs. The bottom line is that, in this, Solarwinds were behind the curve in updating their end. You could have logged a support ticket and obtained directions to a buddy drop, but for the effort involved for our environment we opted to wait for it to be baked into the product.
As of v2024.2.1 this is now baked in [and maybe even from 2024.2 but we skipped that version].
However, despite assurances that this fixed the issue we were still seeing 'connection refused'. I spent ages once again digging in to the logs, running traces, etc and I even took a guinea pig firewall and disabled the secure ciphers (enabled is now the default for FortiOS 7 and up), but still it was the same old error. In frustration I raised a new ticket and after battling past the "default" logs please request they could offer nothing new other than an option to 'take it to engineering'.
And yes, before you asked, I even made sure we had followed the advice found here: https://solarwindscore.my.site.com/SuccessCenter/s/article/SolarWinds-NCM-2024-1-0-BD-OO-29404-additional-steps?language=en_US&name=SolarWinds-NCM-2024-1-0-BD-OO-29404-additional-steps which made no difference.
In semi frustration I reverted to the default (or built-in) Fortinet template which, as if by magic, worked.
And lo, a light shone bright. So I dug into the xml of the out-of-the-box template, and discovered that two lines had been added. I copy/pasted these into our template** and gloriously we got successful backups.
If like us, you run an edited version of the template, then those two lines are:
My reason for this little note is that support didn't know about this and it isn't documented in the release notes [at least not that I have spotted] and is here for the benefit of anybody else that might be suffering.
** for those wondering why we run our own version, then in simple terms the OOTB version doesn't back up all of the firewall config.
