CVE-2016-2183 - 3DES Vulnerability - SWEET32

Summary

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
https://nvd.nist.gov/vuln/detail/CVE-2016-2183
https://nvd.nist.gov/vuln/detail/CVE-2016-6329

FortiOS Web adminUI:
After the upgrade ensure following CLI command set:

config system global
set strong-crypto enable
end

FortiOS SSL VPN Web Portal:
After the upgrade ensure ensure following CLI command set:

config vpn ssl settings
set algorithm high
end

Alternative, start from FortiOS 5.4.1, using following CLI command can disable 3des ciphers:

config vpn ssl settings
set banned-cipher 3DES
end

FortiOS VIP, WANOpt, VoIP:
After the upgrade ensure following CLI command set:

config wanopt settings
et tunnel-ssl-algorithm high
end
config firewall ssl-server
set ssl-algorithm high
end
config voip profile
edit [profile-name]
config sip
set ssl-algorithm high
end
next
end
config firewall vip
edit [vip-name]
set type server-load-balance
set server-type ssl
set ssl-algorithm high
next
end
config web-proxy explicit
set ssl-algorithm high
end

FortiOS webfilter override and authentication service:
After the upgrade ensure following CLI command set:

config system global
set strong-crypto enable
end

References

• https://sweet32.info/