A few openswan cmds you should get use to

In this post, we will look at some useful commands using the ispectool under openswan.

This  command is great for identification of ipsec support within linux.

ipsec verify

The next command barf is used  for dumping the configurations into a text file for  analysis. This a ipsec debugging dump


ipsec barf 

Next up we can use the look option to determine iptables status  & chains used.

ipsec look

The last command is for  ipsec auto status and simple to remember. It great for determining the ciphers supported and other various status for connections. It requires  sudo or root permission for execution.


ipsec auto --status

These are commonly used commands in the swan lineup that should be used for trouble shooting. Other useful tools are tcpdump/tshark for packet capturing of IKE and ESP data and for analyze of ph1/ph2 SPIs



Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

fortinet beta v5.4 is out

That's quick , our folks at FTNT has now release the latest beta and actively encouraging end-users involvement. If you review this previous post, than you can learn more about  FTNT beta program.
http://socpuppet.blogspot.com/2014/11/a-look-at-fortinet-beta-program.html

So now with  v5.4 and if you have a licensed item(s), you can part take of testing and providing feedback. It also allows you 1st insight and a glance/peek at new features that FTNT plans to offer.

The beta programs stays open until a release candidate has been qualified. This could  take a few months to get to that point. At this point, the beta doors are closed and our main-stream release under the version is now general available to users with support contracts.

The beta program is very unique to FTNT and almost nobody else has anything similar from my review & knowledge


http://beta.fortinet.com/

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

finally ikev2 PANOS 7.0.0

I was looking the release notes over a few days ago and  PANOS 7.0.0 has ikev2 support.

So what this means, now I can enable  ikev2 within all of my vpn to just about every other firewall vendor without  worrying about compatbility.

It's time for upgrades;)

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

ipv4 allocation updates

I 'm researching some stuff about ipv4 allocation and found the following link;

http://www.potaroo.net/tools/ipv4/

With ipv6 allocations is more uniform and equally balanced between RIRs.

Regional Internet Registery
APNIC	Asia Pacific
AFRINIC	Africa
ARIN	USA, Canada, Caribbean and North Atlantic islands,
LACNIC	Latin America and the Caribbean
RIPE NCC	Europe, the Middle East, and parts of Central Asia

 http://www-public.it-sudparis.eu/~maigron/RIR_Stats/

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

disktest fortiOS

If you suspect a bad disk, you now have the ability to use the diag disktest command under FortiOS to  validate the disk integrity

You can set the number , size, and cycles to run.

e.g
  SOC60D (global) # diag disktest dev 1
  Current Test Device: /dev/sda

  SOC60D (global) # diag disktest time 120
  Current Time Limit: 120 seconds

  SOC60D (global) # diag disktest size 2
  Current Size Limit: 2 MB

  SOC60D (global) # diag disktest run
 
The unit will run unlimited cycles,  unless you specify the  # of cycles using the following;

   diag disktest run <insert  # of cycles )

All tests will run  unless cancel  the test cycle early. It best to execute  this command during low usages. I never was able to  execute this against any  usb-thumb-drives.

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

macosx ipsec client nat-keepalive validation

You can take a packet capture of traffic from  your macosx client, and by reviewing the timestamps you can check and validate the keepalive intervals for NAT-T.

In this example, my vpn-concentrator is located at 192.0.2.1 & the macosx client KAs are at a 20sec interval.

The KAs will ensure the firewall doesn't close the UDP sessions from the connections and/or nat-transaction tables.


Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

howto 802.1q tagged subinterfaces for MACOSX

In this post I will show you how to  create tagged  802.1q subinterfaces under MACOSX.

By using the  plumb cmd you can create a subinterface. You could also use create just as equally. The cmd is simple and require the word vlan and not just any name

note: take notice that the subinterface mtu will be reduced due to the 4bytes overhead for 802.1q. This will be based off the physical interface MTU.

 To remove a interface, just unplumb it.

That's how simple and the few simples steps required for 802.1q tagging and MACOSX.

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \