ipv6 cleanup fortigate

Here's some  general ideals for when changing your ipv6 address on a fortigate. It make sense to clear all address and flush neighbor-cache if you make any changes. This will release and start fresh without any system reboots.

To clear  these items, please use the following diag commands;

The following  commands are good for monitoring resources usage;

Points to under take with regards to ipv6;

• ipv6 address changes are simple to make
• a interface can have multiple global ipv6 unicast address 
• but only one link-only fe80::/10 address
• it common to change any ipv6 address with no issues
• use the above suggested commands for any diagnostics and for monitoring

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

MACOSX 10.10.5 upgrade ( my rant )

Here's a rant.

Apple continue to amaze me on just how badly they are becoming. From hardware or software, they are dropping in quality. Simple updates are failing and software is not what it used to be.

I've been trying to upgrade a simple macbook 11" from 10.10.4  to 10.10.5 for the last 5 days,  and no matter what method I take, the system completes the OS download and  upon restart, never makes it into yosemite 10.10.5.

https://en.wikipedia.org/wiki/OS_X_Yosemite

Very sad and what's up with the lock button when you try to open iTunes during a upgrade?

Apple should roll-out a new label  named "iDisaster"  for there next OS major release. Support is also getting very clueless &  it's like Apple hired a lot of $MS$ engineers.

It's also a good thing to review all CVEs related to the apple lineup of software;

https://support.apple.com/en-us/HT201222

So for now;


1>  my logs show nothing.

( cat /Library/Receipts/InstallHistory.plist )

2> And i'm still stuck in  10.10.4 and no updates.

So I ended up download the 2gb  download combo after trying a  manual update from the cli & a restart. This failed also.

Here's apple support link for  the direct software update file that's going on now. I will post a comment if that completes.

https://support.apple.com/kb/DL1832?locale=en_US

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

cisco ASA 9.5.1

The folks at cisco has release new software for the ASA 9.5.1. So this is new code is very interesting since we had no other sub-builds under 9.4.x

The one release note item that caught my attention, was support for  PBR-ipv6-routes.

Migration is simple depending on what software version your running now;

Maybe, Maybe I will run the 9.5.1 to see what's under the hood .

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

Fortimail 5.1 b281 is a charm

A few of my  FML3KD appliance are running  5.1. build 281 & have very good stability and run like a charm. I want to upgrade a few, but so far I have resisted the temptations.

The fortimail is one of the best and simplest  Email Security Appliance to deploy outside of a barracuda. It 's not as feature rich as cisco "IronPort" ,  but for the most bang for the buck, it's not shabby either.

http://www.fortinet.com/products/fortimail/

https://www.barracuda.com/products/emailsecurityservice

http://www.cisco.com/c/en/us/products/security/email-security-appliance/index.html

 Fortinet has offerings from a SMB to larger SP arena to cover the wide audience email security needs

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

More fortiOS 5.2.4 woes

I spent over  2 days trying to figure out why a fortigate was missing parts of the configuration after a 5.2.4 upgrade. I ran across this CSB from  support@fortinet and now I realize it was not me


The CSB

It seems like fortiOS has left quite a few end-users asking a lot of ????????s

I don't know what's wrong with Fortinet lately but things just don't work or work very badly. We can only hope 5.2.5 fixes a lot of the issues seen in 5.2.4

As usual in any upgrade you should;

   > make backup
   > have re-convert plan
   > download the existing  OS version in case you need to revert
   > monitor post upgrades
   > monitor support for any CSBs

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

A fortigate reboot script

This is a expect script for rebooting the fortigate at scheduled time using the unix  "at" or "cron" schedulers.

The script can use set variables for  the address or user/password if you so desire.

------------------------------    SOF -----------------------
!/usr/bin/expect -f

# Set variables
 set host [lindex $argv 0]
 set user myusername
 set passw mypassword
# 
#
#
spawn ssh -p 22 -o ConnectionAttempts=5 -o ConnectTimeout=60 -o StrictHostKeyChecking=no $user\@$host
#
#
expect "assword:"
send "$passw\n"
expect "FGT"

send " config global\n"
expect "(global)"

send "execute reboot\n"
expect "(y/n)"

send "y\n"
expect "onnect"

------------------------------------ EOF ------



You can run it using any of the following;

e.g

(unix      at)

at -f <filename >  23:00
 ( for quick execution)

(unix   cron)

59 23 * * * <filename>  >/dev/null 2>&1

 ( regular daily or weekly or monthly execution )




Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \




Tightening up junOS SRX and ssh access

In this blog, we will look how we can control ssh ciphers and by manually configuring our ssh  parameter, you can ensure that clients conform to your security profiles and policies.

In my side role,  we had a audit and want to remove AES128 support from ssh server platforms. In this case our  Juniper gear was still supporting cbc and ctr  with AES128. So we decided to enforce  AES192/256 blowfish and chacha across the board.

We also want to remove the RSA function for the server key.


Here's the cfg;

To test, we just use the ssh client and specify the weaker ciphers in this case aes128 was strike from the  SRX.

And here's the server ssh key finger_prints, notice the after and before ( green / red ) circles

This allowed us to tighter access via our ssh clients access.


Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \