Howto determine if your fortinet appliance is enable for fortiguard rating

An alternative method for determining the contract status of your fortinet security appliance is to look at the diag debug rating output.


Here's a few samples of the diag debug rating command output

( A valid fortimail appliance )

( A non-valid fortimail appliance )

( A valid fortigate appliance )

( A non-valid fortigate appliance )

https://www.fortiguard.com/


Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

SCE8000 upgardes to 5.2.0

Cisco just released code for the SCE 8K series a few weeks ago. This will give us some ideals to see what's has been improved if anything in this latest code.

Good luck

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

qcow2 snapshot removal virtualbox

Using the  virtualbox with with a existing qcow format image, you need to  remove the snapshot that are reference in the image. If you didn't know,  "qcow" format images supports  snapshot-creation where as a "raw" format does not.

The VirtualBox  also support the vdi format so in the end  you really need to convert the qcow2 image.

I found  this error when trying to handle a qcow2 format image within  virtualBox which prompted me to demo how to remove snapshots.


( here's the typical error  )

( here's list of snapshots using the qemu-img command )

( the same image after we deleted the snapshots using  the qemu-img command )

In the end I took my  "qcow2" image and converted it to "vmdk" format to use in Oracle's VirtualBox.

qemu-img check -f qcow2 radius.qcow2
qemu-img convert  -O  vmdk ./radius.qcow2 radius1.vmdk

Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

FTNT fortinet demos

Fortinet is one cool company, they offer online presences for most fortinet appliances. I don't know of any other security outfit that offers anything similar.

Also ALL partners can arrange for onsite-demo and provide hardware and assistance with a PoC or Bake-Off.

Here's a clue,"most fortinet products from FTNT starts with "Forti"  in the name"

Typically ALL logins follow the following format;

    user = demo
    password  = demo

!!!!!!HTTPS only access Read-Only so you can't change anything!!!!!

What I found that was quite funny,  this ( Fortinet FTNT ) is a security solution company, and they have sslv3 enable on a few of the demo appliances for the internet facing management access. Not good!

They should be leading by best practices & by setting good examples. Maybe they forgot & maybe they don't scan demo appliances but .....ssl2 & ssl3 are dead protocol versions that should be stricken and disable. I guess even for a demo appliance from a network security outfit it should be have been disabled!

https://disablessl3.com

Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

update on my MACOSX 10.10.5 OSupdate

Here's what I had to do to get a mac airbook up and running on macosx10.10.5. I had to download the 2gigs updater package and commit the upgrade. This approx 30mins to download.

So the auto update always failed until we conducted the manual package updater.

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

Fortigate SSLVPN certificate & key, observations from SocPuppets

In this blog I will explain how easy it is to change the SSLVPN certificate. The reasons for this requirements varies by the organization & individual needs

•  weak or small keysize
•  compromised  cert/key or CAtrust broken
•  server-certificate has been revoked
•  standardization 
•  certificate expiration issues
•  upwind SSL inspection devices ( IPS )
•  other security related issues etc.....

 In this example, I will build 4k bit private-keysize and certificate by using openssl. The certificate will be copy into the vpn-certificate-local settings as a new named certificate & with the matching private-key.

1st let's look at  the openssl  process for  crafting my  selfsign-certificate & key combo.

In a true organization,  you would generate a CertificateSigningRequest and have a valid CA sign the CSR using a validate signing certificate. This could be a public CA or a organization internal CA.

Here's my openssl usage;

note: for demo, I  crafted this certificate for 1 day. In  reality you will determine the lifetime for the certificate ( e.g 1 2 5 10 years , or whatever your needs are ).

Next, you will login into the  fortigate via the cli and copy the key.pem and cert.pem contents.

note: I find it easier to copy the text output. Fortigate WebGUI has had issues with the certification importation in the past YMMV. Alot of earlier 5.2.2 users complain of certificate uploads via the WebGUI failing.

For the key.pem extract the lines including and between the following;

 -----BEGIN RSA PRIVATE KEY-----

-----END RSA PRIVATE KEY-----

config vpn certificate local
    edit < new name>
      set password < passphrase for the key>
      set private-key < insert the fill private-key with the above lines enclosed between "" >
      set certificate < insert the certificate with the lines  listed below enclosed between "" >
     end

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

Here's an abbr sample for demo purpose.

     config vpn certificate local
              edit  BLOGVPN
                    set password mysuperduperpassphrase
                    set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIJjjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI5bT0Ij9bJEoCAggA
MBQGCCqGSIb3DQMHBAiWEavbTxfX/wSCCUjfan5FatIirXz7rT1VVmPIGf7Vsuq3
B2Dofw5RoZZQfqG6k1VqHmVJy4TWbx/LC+IcI5HT3mV6hNec2YhPqeCUa09k4KPNWzvqQiCYs2OUp3cD81UHfnNUac+ojrvFt89
Yig=
-----END ENCRYPTED PRIVATE KEY-----"
                    set certificate  "-----BEGIN CERTIFICATE-----
MIIGJzCCBA+gAwIBAgIJAOssdGVn7IsUMA0GCSqGSIb3DQEBBQUAMGoxCzAJBgNV
BAYTAlVTMQswCQYDVQQIEwJJTDEMMAofHhnTSMvm1c8RbMKrp22R6xFb8TjsUCAoGBiSQ0Krj2lc+dUBqIO+Yt9twquoP
8yb2ZoXBVuOWbXfXMddkMCNkELBzdNLM/3tx2FlNg2w7SjqdFpjpRlgGACyjwfnA
J8WnHnMI4tYDBAup+QItSmpuYIK7fFwhEre8LYQs3Dg419r7F12xGv0nYg==
-----END CERTIFICATE-----"
end



Now you can validate the certificate within the  WebGUI .

note: You will need to have  the WEBgui enabled for  showing the certificates.

Okay, now we have to tell our fortigate ssl-vpn-settings configuration to use the certificate.

That's how simple and quick  it takes for installing a new certificate/key within a Fortigate Appliance.


Key points;

•  keep the cert and private-key secured

•  optional you can extract the private-key passphrase via openssl, if  you do  this step you don't  need to set the set password command

•  always validate the key  details ( DATEs,SERIAL#, keysize, FINGERPRINT etc...)

•  You can delete the certificates via the CLI or WEBgui 

• If you fear  the NSA or your Gov, craft a csr with a  2k bit or 4k bit keysize

•   search for my other cool openssl tricks/tips  

https://www.google.com/search?q=openssl+socpuppets

Observations from the cockpit;

•  The MACOSX Forticlient 5.2.4 hates certificates with a 8K or  greater private-keysize for tunnel-mode but the webportal will work with your webbrowser. The Tunnel mode does not complete the ssl-handshake. This could be a flaw in the actual forticlient ( I've tested this on  both Window, Android & MACOSX  with various results )

• Android will not work with a 16k bit keysize. I believe the cpu size is the reason behind it. Using  diag debug app sslvpn -1 show the android client never read the certificate and stalls. So the SSL-handshake halts when using tunnel-mode.

•  Windows hangs up more than 80% of the the time with a keysize of 16384bits when operating in tunnel-mode. Could be a issue with the forticlient. The web-portal works fine with all browser that I tested including IE.

•  If you copy the private-key/certificate via the cli, be aware of any input buffer with  the copy/pastes process.

• keysize larger than 4k bit are slower for the initial forticlient Session establishment.

• The fortclient continue it's ssl establishment with a certificate that was obviously expired or if the clock where push pass the certificate dates. I thought this was very poor security-practice on FTNT behalf and the forticlient show have acted like chrome/opera/safari browser and warn you or stop the connection .

Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

FML upgrade to 5.2.6

I'm starting upgrades for FM3K D appliances to 5.2.6. So far these are moving very quickly and simple.

Here's one FML  appliance running a 5.1.x code that will be upgraded to 5.2.6 ( aka build 460 ) .

The upgrade path is simple;

1: make a backup b4
2: download the code
3: review the md5 checksums
4: execute the upgrade
5: monitor the systems and logs

After a upgrade the basic testings should consist of the following;

•  ALL management access methods ( ssh, snmp,etc..)
•  ALL interface are pingable that was previously enabled
•  Recheck for any open-relay (mxtoolbox )
•  recheck that the  fortiguard rating ip lookups  completes
•  ensure that system ntp settings and time/date correct
•  Monitor bounce checks for recipient  verification
•  ANY IBE encryptions profiles
•  it's a good time to re-check any SPF and MX records entries for cleanup
•  ALL TLS/SSL enable profiles for mail MAs
•  Double check for sslv3 disable
•  greylist  creations
•  All  AV/AS definitions are up to data!

To learn more about Email Security Appliances, please review the reviews.

FTNT should try to get more "one on one"  comparisons, but the fortimail lineup is typically reliable. They make current models from the small FML60 to the 3K platforms. Most of the big server appliance are based off a dell-type of hardware.


Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \