Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Duncan
New Contributor III

Microsoft Teams SSL.Anonymous.Ciphers.Negotiation

Is anyone else getting SSL.Anonymous.Ciphers.Negotiation IPS notification when using Microsoft Teams? I am getting about 20 per hour with 200 staff. Haven't seen it on my PC yet even though I am running teams. The host names are:

worldaz.tr.teams.trafficmanager.net

worldaz.tr.teams.microsoft.com

3 REPLIES 3
awomack
New Contributor

Yes I am seeing the same

Yurisk
Valued Contributor

Yep, seen as well.

Some more info: https://www.reddit.com/r/fortinet/comments/gtc6k3/what_does_sslanonymousciphersnegotiation_alert/

 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
Jpicou
New Contributor

Seeing the same alert on Fortigate 100D and trying to confirm this is not an issue with MS Teams, because of the way MS is encrypting (see below).  As long as TLS1.2 is used this is not an issue, right?.

 

"Man-in-the-middle attacks on media traffic between two endpoints participating in Teams audio, video, and application sharing, is prevented by using SRTP to encrypt the media stream. Cryptographic keys are negotiated between the two endpoints over a proprietary signaling protocol (Teams Call Signaling protocol) which leverages TLS 1.2 and AES-256 (in GCM mode) encrypted UDP / TCP channel."

https://docs.microsoft.com/en-us/microsoftteams/teams-security-guide

 

Labels
Top Kudoed Authors