Network Management

Additional steps to connect to Fortigate devices after you upgrade to NCM 2024.1 and apply a buddy drop

After you upgrade to NCM 2024.1.1 or later, or apply the buddy drop associated with OO-29404, Fortinet / Fortigate devices are still not able to connect with NCM.

First published date

3/7/2024 2:53 PM

Last published date

5/27/2025 8:26 PM

Overview

The purpose of this article is to outline the additional steps you might need to take to resolve the issue.

After upgrading to FortiOS or Fortigate to 7.2.6 - 7.2.7 or 7.0.13 - 7.0.14, Fortinet devices no longer connect through via SSH in NCM 2024.1 and earlier.

Later versions have the files needed to support for:
  • key signature algorithm of ssh-ed25519
  • hmac algorithms of hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com
  • Ciphers of aes128-gcm@openssh.com, aes192-gcm@openssh.com and aes256-gcm@openssh.com
If the environment is on NCM 2024.1.1 Service Release or NCM 2024.2, when overriding the CLIClient algorithm lists, the default values do not contain all the supported algorithms/ciphers and will still need to go through the steps in the resolution.

Product section

Network Configuration Manager

Cause

The following issue occurs due to the following reasons:

  • In Fortigate / FortiOS 7.2.6 and 7.0.13, ssh-rsa was removed from key signature algorithm and ssh-ed25519 was the only key signature algorithm.
  • In Fortigate / FortiOS 7.2.7 and 7.0.14, key signature algorithm were changed.

Without a buddy drop, NCM 2024.1 does not support the key signature algorithm of SSH-ED25519.

FortiOS ID 874292, where the RSA algorithm was removed for being obsolete.

FortiOS 7.2.6 ID874292:
ssh-rsa should be disabled under the SSH server_host_key_algorithm.

Reference documentation:

Resolved issues | FortiGate / FortiOS 7.2.6 | Fortinet Document Library 

Resolved issues | FortiGate / FortiOS 7.0.13 | Fortinet Document Library 

Known issues | FortiGate / FortiOS 7.2.7 | Fortinet Document Library 

Resolution

Upgrade or apply a buddy drop:

To resolve this issue, perform one of the following: 

  1. Upgrade to SolarWinds Platform 2024.1.1 or later.
  2. If SolarWinds Platform 2024.1 is installed and cannot upgrade, apply the SolarWinds-NCM-2024-1-0-BD-OO-29404 buddy drop. 


Important! Buddy drop for NCM must be applied to SolarWinds Platform 2024.1.

To obtain the buddy drop, please create a technical support case and SolarWinds Technical Support will validate the issue and provide the buddy drop. Apply the Buddy Drop using the instructions provided in the ReadMe file.

Additional steps (general)

If the issue persists after you upgrade or apply the buddy drop, complete the following additional steps:

  1. From the SolarWinds Platform Web Console, change the URL to the following to open the advanced configuration section:
    • http://servername/orion/admin/AdvancedConfiguration/Global.aspx
  2. Search for AllowOverrideSshAlgorithms.
    Note: If Windows FIPS is enabled, the priority order in advanced settings will not be honored.  Windows FIPS settings and priority orders will take precedence.
  3. Select the checkbox to enable the AllowOverrideSshAlgorithms option.
    image.png
  4. Search for KeySignatureList.
  5. Edit the section and add ssh-ed25519 to the beginning of this list:

    ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ssh-rsa,ssh-dss

    image.png

    image.png
  6. At the bottom of the edit screen, click OK.
  7. Search for EncryptionList.
  8. Edit the section and add aes256-gcm@openssh.com at the front of the list:

    aes256-gcm@openssh.com,aes128-ctr,aes128-cbc,aes128-gcm@openssh.com,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes192-gcm@openssh.com,aes256-ctr,aes256-cbc,chacha20-poly1305@openssh.com,rijndael-cbc@lysator.liu.se

    image.png

    image.png
  9. At the bottom of the edit screen, click OK.
  10. At the bottom of Advanced Settings, click Save.
  11. Test the connection to the Fortinet device and confirm the issue is resolved.

Additional steps for Cisco devices

Optionally, some vendors (such as Cisco IOS) may require the following additional changes to the KEX and HMAC list.  If other vendors do not work with NCM, make the following changes (in the Advanced Configuration global page) to KeyExchangeList and  HMACList:

KEX: 
diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ext-info-c
HMACList: 
hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,none