SSLVPN fortigate with certificates

In this post, I will demonstrate how to use and enable sslvpn with end-user certificates. The remote firewall is running 6.2.3 and we are using the 6.2 vpn client

I'm using firefox to test the web-portal and an android & macosx device running the basic forticlient

In the fortigate you should set a "config user peer" and define the CA that's signing the end-user certificates. This cert along with the rootCA certificate needs to be uploaded into the fortigate via the

System > certificate


In my setup, I have a root and intermediate CA. The "config user peer" is using my intermediate CA for the config.

config user peer

    edit "socpuppets-intermediate"

        set ca "CA_Cert_3"

    next

end

Now you will need to build your sslvpn settings to include an authentication-rule.

config vpn ssl settings

    set reqclientcert enable

    set ssl-min-proto-ver tls1-1

    set servercert "Fortinet_Factory"

    set tunnel-ip-pools "SSLVPN_POOL_1"

    set port 8443

    set source-interface "wan1"

    set source-address "all"

    set source-address6 "all"

    set default-portal "full-access"

    config authentication-rule

        edit 1

            set source-interface "wan1"

            set source-address "all"

            set groups "vpnusers1"

            set portal "full-access"

            set client-cert enable

            set user-peer "socpuppets-intermediate"

        next

    end

end

And the portal cfg with address pool

config firewall address

    edit "SSLVPN_POOL_1"

        set subnet 10.199.199.0 255.255.255.0

    next

end

config vpn ssl web portal

    edit "full-access"

        set tunnel-mode enable

        set ipv6-tunnel-mode enable

        set web-mode enable

        set ip-pools "SSLVPN_POOL_1"

        set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"

    next

end

So no when a end-user authenticates and matches that auth-rule, he will need a valid certificate that matches the use-peer

Once you have connected you can validate users via the cli or webUi

if your forticlient can not connect, use firefox and access the webportal , import the certificate that's being used by the forticlient. If you can access the webportal, than the certificate and authentication rule is good.









One last tidbit, when the user certificate has expired the user will be locked out of the vpn. Since the certificate verification is done before the acceptance of the "username/password" you will not see this in the logs but "diag debug application sslvpnd -1" will clearly show this scenario

For traffic that's allowed by the firewall policy you can use 

diag debug flow or run a diag packet sniffer on ssl.root interface to see the traffic flow

This vpn method offers a means to easily control vpn-users for a timed-access-control by signing the certificate for "X"  amount of days. Great for vendors, auditors, or consultant access.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

FORTIGATE IPV6_PD

In the fortigate it so easy to enable IPV6-DHCP-PD for ISP that advertise dhcp6 and delegation of prefixes.

Here's a simpel config where port1 is your ISP uplink and port2 is one our local-lan for ipv6



config system interface 
edit port1  
    config ipv6
         set ip6-mode dhcp
         set dhcp6-prefix-delegation enable
         set dhcp6-prefix-hint ::/56
         set dhcp6-prefix-hint-vlt 0
         set dhcp6-prefix-hint-plt 0
     next 
 end
end

config system interface
    edit "port2"
        config ipv6
            set ip6-mode delegated
            set ip6-allowaccess ping https ssh
            set dhcp6-prefix-delegation enable
            set ip6-send-adv enable
            set ip6-manage-flag enable
            set ip6-other-flag enable
            set ip6-upstream-interface "wan2"
            set ip6-subnet ::/64
            config ip6-delegated-prefix-list
                edit 1
                    set upstream-interface "port1"
                    set autonomous-flag enable
                    set onlink-flag enable
                    set subnet ::/64
                next
            end
        end


You can check for local route and ipv6 reachability from the cli,


 get router info6 routing-table
 execute ping  2620:119:35::35
 execute tracert6 2620:119:35::35

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

Route-Based ikev2 vpn juniper SRX to Fortigate RSA-cert

In this post  we will do the opposite of this previous  blog post .

http://socpuppet.blogspot.com/2019/10/fortigate-to-juniper-srx-vpn-route.html

Here we have the Juniper SRX making a connection as "initiator" to a FortiGate as a  "responder-only" and using certificates for authentication method. We are using IKEv2.

Since the fortigate is a responder, all traffic has to be initiated from the SRX side. Like previously,
I'm using getacert for the CSR signing and the same steps will apply here. In real life this would be your private CA or a certificates issued from a public-CA. You will always need to ensure the rootCA is imported into both the firewalls.

• draft csr for both the juniper and fortigate
• have the csr signed by the rootCA
• import the cert and rootCA-cert into the devices
• ensure your record the exact CN strings that are used in the certificates ( I will explain later )

junos

      request security pki generate-key-pair size 2048 type rsa certificate-id srx300

      request security pki generate-certificate-request certificate-id srx300 subject "CN= srx300" domain-name srx300.socpuppets.com 

 send the csr to your  CA for signing and then copy the  resulting certificate into the juniper SRX


Once you have the cert copied to the  juniper, you will do the following

   request security pki local-certificate load filename <filename of your x509 cert>  certificate-id srx300


For the root ca you do the same thing but must use the following;

request security pki ca-certificate load filename < filename root CA > ca-profile getacert

 If CRL is available in the rootCA you need to disable it for  this ca-profile

    set security pki ca-profile getacert revocation-check disable


For the fortigate, just use the WebUI and craft a CSR and then submit that CSR and import it along with the cert into the fortigate.

System > Certificate
   

I broke the junos cfg down to ph1/ph2 and routing. You will also need a security policy for the permitted traffic which I did not show.

Fortigate side is less involved but the same details exist. You will need firewall policy for the permitted traffic.

One last item on the FGT we are using only the "ca cert" to validate the peer in the above example.

What this means, any cert issued by GETACERT would be honor. In reality, you would lock it down to the"cn" in the remote peer and the rootCA that signed that certificate. I will explain later on why.

So to lock it down, you would call the name CA cert and CN  string of the peer. This combination will validate that peer and only if signed by that rootCA and if the certificate date is still validated.

I will speak more about this later and on why the 1st example was used and how it can help with troubleshooting.

Here's some show and diagnostic output of the Security-Associations.

junos

fortios

On trouble-shooting and when your dealing with certificate the rootCA and CN names act like the pre-shared key  along with the certificate , if you may.

So in my case, I can controlled both end-points which make diagnostic real easy. In a real deployment, you might have a different fw-admin for one the remote-firewall.

So if the remote-fw-admin gives you the wrong "CN" or does not know it, if you use just the rootCA and blindly accept the certificate, you can then ascertain the "CN" after the peer has initiated. Then you can add that to your "config user peer" statement once known.

I worked a issues a few months back where we had a FGT1500 trying to authenticate to a openswan and the remote-fwadmin thought he used  cn=XYZ.hisdomain1.com but in reality, he used cn=XYX.hisdomain2.com and they could never be authenticated.

I use the just the cert-CA for validation and "diag vpn ike gateway | grep CN", then I could explore the actual certificates CN field of the remote-firewall.

traceroute

Further diagnostic tips

junos

       request security ike debug-enable remote <destination-gw address>  local <local gw address>

       review the kmd logs after enabling the above

          file show /var/log/kmd*

PLEASE DISABLE THE DEBUG AFTER FINISHING YOUR COLLECTION

         request security ike debug-disable

fortios

   diag debug reset 

   diag debug enable

   diag debug application ike -1

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

HOWTO recover a corrupted SRX file system

In this post, I will show you how you can use a functional Juniper SRX to repair a corrupt SRX firewall by using a usb-drive.

The 1st steps are to have a similar model SRX and a usb-drive. On the working SRX, you will build snapshot and specify the usb-drive as the media type.

      request system snapshot media usb

This can take some time, so be patient.


Next, insert the usb-drive into the bad SRX and power on. The device should scan the usb bus and boot from this drive. The time could be upwards to 10-15mins before it has fully boot.

Next, login into the SRX  device;

It's a good time to look over the storage ;

And finally, you will do the 2nd snapshot but this time to media internal.

     request system snapshot media internal



 This could take some time so be patient.



This should net you a snapshot of the current junos version and configuration to the internal drive from the usb-drive that was insert.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

Checkpoint Security Gateway traffic-selectors for route-base

This is a common missed item when working with checkpoint and route-based vpns that uses 0.0.0.0/0 for the security-associations.

In the "vpn-communities" properties , you need to set the vpn type as one vpn tunnel per gateway  for route-based vpns that uses 0.0.0.0/0s for proxy-id {aka traffic selectors }

If you do not enable this, you will have mismatches and the tunnel will never work.

TIP: use the expert mode to see the negotiate for the SPI inbound and outbound

e.g
 
   fw tab -t inbound_SPI -m 1000 
   fw tab -t outbound_SPI -m 1000 

It would look similar to the below when all 0s are in play.

  9:26:37 5 N/A  N/A    10.20.204.4 > N/A  LogId: <max_null>; ContextNum: <max_null>; OriginSicName: <max_null>; SPI: 13608394; Protocol: IPSEC_ESP_SA(2); Schema: IKE(3); Me: 172.20.12.9; Peer: 12.0.1.132; Owner: 127.0.0.1; MyRange:First: ; Last: 255.255.255.255; PeerRange:First: ; PeerLast: 255.255.255.255; HWInitialized: NO; MSPI: 4160; Host: 172.20.12.9; Expires: 2327/3610; LastUpdateTime:  3Apr2020  9:26:37; ProductName: VPN-1 & FireWall-1; ProductFamily: Network;

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

How to make a RSI for juniper SRX

For juniper support it's common to build a RSI ( request support information ) for the JTAC. IN this post, I will show you a simple one step  method to building and compressing a RSI file

From the cli you can string the commands to simplify the task.

start shell command "cli -c 'request support information | save /var/log/RSI-APR03-2020.txt ; file compress file /var/log/RSI-APR03-2020.txt '"


You can monitor the file creation and size via the following command


    file list /var/log/RSI* detail

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

IPV6 tunnel and Juniper SRX

My ISP changed address on me, so I had to update my  hurricane electric ipv6 tunnel configuration and figure I would write about the tunnel concept. I've previously written about HE tunnel broker many times in the past

http://socpuppet.blogspot.com/2014/07/getting-free-ipv6-experience-by-using.html


Hurricane Electric has one of the best free ipv6 tunnel-broker service.  The tunnelbroker.ch is also good and has a simpler interface. The later has less gateway, a simpler interface  but works just the same as HurricaneElectric.

In the JunoSRX you must use the "ip" interface which is proto 41 { IP n IP} for the interface type.

So in the above we have 2 tunnels configured for services unit 0 & 1. I'm using  HE for the local lan and have a /64 prefix available. We are using  ipv6 advertisements for stateless configuration.

This allows my mac , linux, window hosts to acquire a address for the lan.

Now we can test  ipv6 access once my policy has been applied


Here's me testing iv6 dns and my pings to gmail.com

You can use " show security flow session family inet6" to see any ipv6 sessions on the SRX.

I hope this helps .

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \