Fortigate new sofware SSH error with NCM

Hi, I have seen the exact same issue and thought I would shed some  light on this matter for you .

ssh-rsa is no longer be offered as the server key host algorithm after upgrading to FortiOS 7.2.6 it ONLY offer the ssh-ed25519 algorithm !

You need to enable 3ed25519 (this is dh grp 19 the start of the elliptic curve. even when you disable to strong crypto (not recommend unless  it test lab) the old ssh-rsa key is no longer offered. You can update the NPM / on Solarwinds/Orion a=or create a new ssh host key but the global setting will not work  even with the SHA1 DH1 specified in the algo's. The ssh-rsa (sha1 is old and should be deprecated) Our FortiGates and ASA on the newer OS are hitting this issue

The same key host algorithm offering  can be verified in the SSH debugs:

 
7.2.5 logs
2123-10-2110:08:21 SSH: Proposal: 0, Ciphers: 'diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp081'
2123-10-2110:08:21 SSH: Proposal: 2, Ciphers: 'chacha21-poly1305@openssh.com,aes256-ctr,aes256-gcm@openssh.com'
2123-10-2110:08:21 SSH: Proposal: 3, Ciphers: 'chacha21-poly1305@openssh.com,aes256-ctr,aes256-gcm@openssh.com'
2123-10-2110:08:21 SSH: Proposal: 4, Ciphers: 'hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com'
2123-10-2110:08:21 SSH: Proposal: 5, Ciphers: 'hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com'

**** 2123-10-2110:08:21 SSH: list_hostkey_types: ssh-rsa,ssh-ed25519

2123-10-2110:08:21 SSH: SSH2_MSG_KEXINIT sent
2123-10-2110:08:21 SSH: SSH2_MSG_KEXINIT received
2123-10-2110:08:21 SSH: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp081
2123-10-2110:08:21 SSH: kex_parse_kexinit: ssh-rsa,ssh-ed25519
2123-10-2110:08:21 SSH: kex_parse_kexinit: chacha21-poly1305@openssh.com,aes256-ctr,aes256-gcm@openssh.com
2123-10-2110:08:21 SSH: kex_parse_kexinit: chacha21-poly1305@openssh.com,aes256-ctr,aes256-gcm@openssh.com
2123-10-2110:08:21 SSH: kex_parse_kexinit: hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com
2123-10-2110:08:21 SSH: kex_parse_kexinit: hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com
###########################################################################################################

###########################################################################################################

####    7.2.6 logs     ***** Shows it only offer ssh-ed25519.

2123-10-2110:09:08 SSH: Proposal: 0, Ciphers: 'diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp
081'
2123-10-2110:09:08 SSH: Proposal: 2, Ciphers: 'chacha21-poly1305@openssh.com,aes256-ctr,aes256-gcm@openssh.com'
2123-10-2110:09:08 SSH: Proposal: 3, Ciphers: 'chacha21-poly1305@openssh.com,aes256-ctr,aes256-gcm@openssh.com'
2123-10-2110:09:08 SSH: Proposal: 4, Ciphers: 'hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com'
2123-10-2110:09:08 SSH: Proposal: 5, Ciphers: 'hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com'

**** 2123-10-2110:09:08 SSH: list_hostkey_types: ssh-ed25519

2123-10-2110:09:08 SSH: SSH2_MSG_KEXINIT sent
2123-10-2110:09:08 SSH: SSH2_MSG_KEXINIT received
2123-10-2110:09:08 SSH: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp081
2123-10-2110:09:08 SSH: kex_parse_kexinit: ssh-ed25519
2123-10-2110:09:08 SSH: kex_parse_kexinit: chacha21-poly1305@openssh.com,aes256-ctr,aes256-gcm@openssh.com
2123-10-2110:09:08 SSH: kex_parse_kexinit: chacha21-poly1305@openssh.com,aes256-ctr,aes256-gcm@openssh.com
2123-10-2110:09:08 SSH: kex_parse_kexinit: hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com
2123-10-2110:09:08 SSH: kex_parse_kexinit: hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com


##############################################################################################################

Kind regard

Steven

"You can update the NPM / on Solarwinds/Orion a=or create a new ssh host key"

Is this something you can explain a little bit more?  It sounds like you were able to do this as a workaround and get NCM to work on the fortigates?

 FortiSteve 

Seems to be a bug in FortiOS 7.2.6 according to FortiNet.  There is no fix for the Fortigate unless you upgrade firmware to 7.4.  Is there a way to have  NCM to use the current encryption?

Are there any other updates to this issue by anyone? Thank!

Solarwinds support told us they will be upgrading their ciphers in the 2024.1 release.  They are still using an SSH client from 2009 that doesn't support ed25519.  Until then it's just keep your FGs on 7.0.12 I guess.

Okay, thanks for the information!

Just updated NCM to 2024.1

This is still an issue

Have this exact same problem and opened a ticket with Solarwinds support.

After some going back and forth with support offering different "solutions" by wanting the Fortigate configs to be changed, and a final recommendation(after their "research") to upgrade to 7.4.x,  not once admitting it was a problem with Solarwinds.

I pushed back with my own "research" stating that NCM doesn't support updated or "modern" algorithms.

Support just replied stating that they take "full responsibility" and that the bug will be fixed in v2024.2!

2024.2 won't be released until June 5th 2024! 

HI Gunny, Thanks for the info.  We had pushed to get  SSH libraries to upgraded not even given them a chance to blame the firewall firmware but they were not helpful  at all. Given they had such a bad security breach in the past I was hoping they might be keen to get rid algorithms that deprecated in 2020 (SHA1, des 3des).

They have had n numerous requests to do this from what I have seen over the last few years on various forums and speak with ex colleague etc , it really beyong a joke and normal reasoning to why they take this approach