Route-Based ikev2 vpn juniper SRX to Fortigate RSA-cert

In this post  we will do the opposite of this previous  blog post .

http://socpuppet.blogspot.com/2019/10/fortigate-to-juniper-srx-vpn-route.html

Here we have the Juniper SRX making a connection as "initiator" to a FortiGate as a  "responder-only" and using certificates for authentication method. We are using IKEv2.

Since the fortigate is a responder, all traffic has to be initiated from the SRX side. Like previously,
I'm using getacert for the CSR signing and the same steps will apply here. In real life this would be your private CA or a certificates issued from a public-CA. You will always need to ensure the rootCA is imported into both the firewalls.

• draft csr for both the juniper and fortigate
• have the csr signed by the rootCA
• import the cert and rootCA-cert into the devices
• ensure your record the exact CN strings that are used in the certificates ( I will explain later )

junos

      request security pki generate-key-pair size 2048 type rsa certificate-id srx300

      request security pki generate-certificate-request certificate-id srx300 subject "CN= srx300" domain-name srx300.socpuppets.com 

 send the csr to your  CA for signing and then copy the  resulting certificate into the juniper SRX


Once you have the cert copied to the  juniper, you will do the following

   request security pki local-certificate load filename <filename of your x509 cert>  certificate-id srx300


For the root ca you do the same thing but must use the following;

request security pki ca-certificate load filename < filename root CA > ca-profile getacert

 If CRL is available in the rootCA you need to disable it for  this ca-profile

    set security pki ca-profile getacert revocation-check disable


For the fortigate, just use the WebUI and craft a CSR and then submit that CSR and import it along with the cert into the fortigate.

System > Certificate
   

I broke the junos cfg down to ph1/ph2 and routing. You will also need a security policy for the permitted traffic which I did not show.

Fortigate side is less involved but the same details exist. You will need firewall policy for the permitted traffic.

One last item on the FGT we are using only the "ca cert" to validate the peer in the above example.

What this means, any cert issued by GETACERT would be honor. In reality, you would lock it down to the"cn" in the remote peer and the rootCA that signed that certificate. I will explain later on why.

So to lock it down, you would call the name CA cert and CN  string of the peer. This combination will validate that peer and only if signed by that rootCA and if the certificate date is still validated.

I will speak more about this later and on why the 1st example was used and how it can help with troubleshooting.

Here's some show and diagnostic output of the Security-Associations.

junos

fortios

On trouble-shooting and when your dealing with certificate the rootCA and CN names act like the pre-shared key  along with the certificate , if you may.

So in my case, I can controlled both end-points which make diagnostic real easy. In a real deployment, you might have a different fw-admin for one the remote-firewall.

So if the remote-fw-admin gives you the wrong "CN" or does not know it, if you use just the rootCA and blindly accept the certificate, you can then ascertain the "CN" after the peer has initiated. Then you can add that to your "config user peer" statement once known.

I worked a issues a few months back where we had a FGT1500 trying to authenticate to a openswan and the remote-fwadmin thought he used  cn=XYZ.hisdomain1.com but in reality, he used cn=XYX.hisdomain2.com and they could never be authenticated.

I use the just the cert-CA for validation and "diag vpn ike gateway | grep CN", then I could explore the actual certificates CN field of the remote-firewall.

traceroute

Further diagnostic tips

junos

       request security ike debug-enable remote <destination-gw address>  local <local gw address>

       review the kmd logs after enabling the above

          file show /var/log/kmd*

PLEASE DISABLE THE DEBUG AFTER FINISHING YOUR COLLECTION

         request security ike debug-disable

fortios

   diag debug reset 

   diag debug enable

   diag debug application ike -1

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

HOWTO recover a corrupted SRX file system

In this post, I will show you how you can use a functional Juniper SRX to repair a corrupt SRX firewall by using a usb-drive.

The 1st steps are to have a similar model SRX and a usb-drive. On the working SRX, you will build snapshot and specify the usb-drive as the media type.

      request system snapshot media usb

This can take some time, so be patient.


Next, insert the usb-drive into the bad SRX and power on. The device should scan the usb bus and boot from this drive. The time could be upwards to 10-15mins before it has fully boot.

Next, login into the SRX  device;

It's a good time to look over the storage ;

And finally, you will do the 2nd snapshot but this time to media internal.

     request system snapshot media internal



 This could take some time so be patient.



This should net you a snapshot of the current junos version and configuration to the internal drive from the usb-drive that was insert.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

Checkpoint Security Gateway traffic-selectors for route-base

This is a common missed item when working with checkpoint and route-based vpns that uses 0.0.0.0/0 for the security-associations.

In the "vpn-communities" properties , you need to set the vpn type as one vpn tunnel per gateway  for route-based vpns that uses 0.0.0.0/0s for proxy-id {aka traffic selectors }

If you do not enable this, you will have mismatches and the tunnel will never work.

TIP: use the expert mode to see the negotiate for the SPI inbound and outbound

e.g
 
   fw tab -t inbound_SPI -m 1000 
   fw tab -t outbound_SPI -m 1000 

It would look similar to the below when all 0s are in play.

  9:26:37 5 N/A  N/A    10.20.204.4 > N/A  LogId: <max_null>; ContextNum: <max_null>; OriginSicName: <max_null>; SPI: 13608394; Protocol: IPSEC_ESP_SA(2); Schema: IKE(3); Me: 172.20.12.9; Peer: 12.0.1.132; Owner: 127.0.0.1; MyRange:First: ; Last: 255.255.255.255; PeerRange:First: ; PeerLast: 255.255.255.255; HWInitialized: NO; MSPI: 4160; Host: 172.20.12.9; Expires: 2327/3610; LastUpdateTime:  3Apr2020  9:26:37; ProductName: VPN-1 & FireWall-1; ProductFamily: Network;

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

How to make a RSI for juniper SRX

For juniper support it's common to build a RSI ( request support information ) for the JTAC. IN this post, I will show you a simple one step  method to building and compressing a RSI file

From the cli you can string the commands to simplify the task.

start shell command "cli -c 'request support information | save /var/log/RSI-APR03-2020.txt ; file compress file /var/log/RSI-APR03-2020.txt '"


You can monitor the file creation and size via the following command


    file list /var/log/RSI* detail

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

IPV6 tunnel and Juniper SRX

My ISP changed address on me, so I had to update my  hurricane electric ipv6 tunnel configuration and figure I would write about the tunnel concept. I've previously written about HE tunnel broker many times in the past

http://socpuppet.blogspot.com/2014/07/getting-free-ipv6-experience-by-using.html


Hurricane Electric has one of the best free ipv6 tunnel-broker service.  The tunnelbroker.ch is also good and has a simpler interface. The later has less gateway, a simpler interface  but works just the same as HurricaneElectric.

In the JunoSRX you must use the "ip" interface which is proto 41 { IP n IP} for the interface type.

So in the above we have 2 tunnels configured for services unit 0 & 1. I'm using  HE for the local lan and have a /64 prefix available. We are using  ipv6 advertisements for stateless configuration.

This allows my mac , linux, window hosts to acquire a address for the lan.

Now we can test  ipv6 access once my policy has been applied


Here's me testing iv6 dns and my pings to gmail.com

You can use " show security flow session family inet6" to see any ipv6 sessions on the SRX.

I hope this helps .

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

CHECKPOINT VPN Diagnostic commands output TIP

I learned something a few days ago when looking at the encryption domain. if you add the -m <xxx> you can see more items than without,

So commands  that might have a long list similar to below;


  fw tab -t vpn_enc_domain -f 
  fw tab -t inbound_SPI -f 
  fw tab -t outbound_SPI -f 

etc.....



If you have a long list of details the output will be cut and truncated, so if you add more with the "-m 100" you can see more in the list output. I hope this might come handy.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

How many ways to determine checkPoint Security Gateway type

Here's a few ways to check  a CPSG  model type.


  dmidecode | grep Product 

 ipsctl -a | grep modelname

 cpstat -f all os | grep -i name

 show asset system


These can help you in your CPSG details.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \