SDWAN fortios ipv6

 Okay here's a new twist . Can you do SDWAN with ipv6 ? Will yes.

Okay so a friend of mine is looking at SDWAN and they are in a all ipv6 environment. I'm going to demo ho w you do SDWAN on fortigate and with ipv6. Keep in mind SDWAN ipv6 addr-mode and configuration is done from cli-only.

Okat 1st what I did was use my 2 ipv6 SIT-tunnels. These are used for ipv6 connectivity since my local-ISP does not even offer ipv6.

Here's a basic tunnel setup;

config system sit-tunnel

    edit "HE"

        set source 199.188.xxx.xxx

        set destination 216.66.80.26

        set ip6 2001:470:1f07:427::2/64

    next

    edit "CH"

        set source 199.188.xxx.xxx

        set destination 85.202.203.249

        set ip6 2a09:4c0:fe0:7a::2/64

    next

end

Next we stick these two interfaces in a SDWAN zone. I named mine simply ipv6;

config system sdwan

    set status enable

    config zone

        edit "virtual-wan-link"

        next

        edit "ipv6"

        next

    end

    config members

        edit 1

            set interface "HE"

            set zone "ipv6"

        next

        edit 2

            set interface "CH"

            set zone "ipv6"

        next

    end

You will need a ipv6 policy in order to use the sdwan and traffic exiting to the ipv6 backbone

config firewall policy

    edit 6

        set name "ipv6-sdwan"

        set uuid 9e0adc14-bdb6-51eb-0138-794f8740485f

        set srcintf "internal"

        set dstintf "ipv6"

        set srcaddr6 "all"

        set dstaddr6 "all"

        set action accept

        set schedule "always"

        set service "ALL"

        set nat enable

    next

end

Notice I used "nat" egress since I have 2 different originating networks so we need to SNAT. My inside lan is configured using private address;

config system interface

    edit "internal"

        set vdom "root"

        set ip 192.168.1.99 255.255.255.0

        set allowaccess ping https ssh snmp

        set type hard-switch

        set stp enable

        set role lan

        set snmp-index 6

        config ipv6

            set ip6-address 2001:db8:99::1/64

            set ip6-allowaccess https ssh snmp

            set ip6-send-adv enable

            config ip6-prefix-list

                edit 2001:db8:99::/64

                next

            end

        end

    next

end

Now you can build sdwan rules & health checks and such but you have to use cli and set the addr-mode type

e.g

       edit "quad9"

            set addr-mode ipv6

            set server "2620:fe::9"

            set detect-mode prefer-passive

            set threshold-warning-packetloss 20

            set threshold-alert-packetloss 30

            set members 1 2

        next

    end

    config service

        edit 2

            set name "ipv6-tunnels"

            set addr-mode ipv6

            set input-device "internal"

            set priority-members 2

            set dst6 "sjc"

            set src6 "all"

        next

    end

So treat the sdwan fo ipv6 in the same fashion a ipv4.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

fortios upgrade from usb

 In some rare instance you might have to upgrade a fortigate from usb. This can be due to numerous reasons

proxy

inside firewall access

a closed system from the internet

etc...

So here's the basic steps

A> read the release notes. This will help you to know what changed , fixes, improvements.

B> study any migration path

C> make a backup configuration 

D> clear the debug config error

E> copy the image to a ms-dot formatted usb-stick

F> start the upgrade

G> check status and read any diag debug config errors

And lastly, you have two partitions, you can always revert back to the inactive partition if you want to reboot in previous  installed version

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

ipv6 sit-tunnel using https://www.tunnelbroker.ch/

 So an alternative to hurricane electric is https://www.tunnelbroker.ch/

The advantage here are;

1.    the user interface is much better design
2.    A API is available

disadvantage 

1.    the free account only offers a /64
2.    you can only craft 3  upto 3 tunnels in the free offering 
3.   total number of end-point regions is much less than hurricane electric

Here's a few snapshots of the portal

API

ipv6 tunnel details

Fortios cfg

 Ping check from keycdn tools

And traceroute source from the /64 for testing;

YMMV but this is an exceptional tunnelbroker for ipv6.

note: their auto-cfg generator for fortios is incorrect {config system sbtb-tunnel}

     

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

ipv6 sit-tunnel using Hurricane Electric

 So you want to try ipv6 but your local provider has no IPv6 capabilities. Use the Hurricane Electric tunnelbroker and build a sit tunnel. HurricaneElectric https://tunnelbroker.net/

1st lets understand what SIT means.

Okay that's what SIT tunnel means and does. So on to the HE tunnel broker the request is simple to execute just make sure the ipv4 outer address on your fortigate is allowing pings.

HE tunnel assignment with a /48 allocation;

Okay now that you have the HE pieces, you can configure the fortios settings. Since I want to test the /48 allocation, I will assign a /64 subnet to a loop back and configure it for icmp6 and a firewall policy. Keep in mind since fortios0 6.4 ipv4/ipv6 policy are now done from with the same hierarchy from the CLI. no more "config firewall polic6"

 

sys sit-tunnel cfg and loopback ( notice allowaccess ping was set ) 

A firewall policy to allow for my testing ;

Okay let's looking over ipv6 route table and do some basic checks

here's  some ping6 and traceroute6  test using the fortigate and loopback address;

Here's me testing from KeyCDN tools for simultaneous pings/traceroutes

 

This was all done on a FGT100E  and with an attach with a tunnel endpoint in EU region.

So to recap, ipv6 support is great in fortios. If you need ipv6 connectivity and your provider does not support ipv6, just use the tunnel services from HurricaneElectric https://tunnelbroker.net/

HE will give you the option to create up to 5  unique sit-tunnels.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

ansible and napalm to get your fortios configuration

 With naplam-fortios you have numerous means to login and do certain commands within fortios. The supported command are listed at the following link below

https://napalm.readthedocs.io/en/reunification/support/index.html#getters-support-matrix

Here's a simple play to gather the fortios config;

- name: fgtconfig
 hosts:  firewall1
 connection: local  
 gather_facts: no   vars_prompt:
  - name: password
   prompt: "password please"
  - name: admin
   prompt: "username please"
   private: no tasks:                   
  - name: getConfigDevice      
   napalm_get_facts:          
    username: "{{ admin }}"        
    dev_os: 'fortios'        
    password: "{{ password }}"      
    filter: 'config'        
   register: result          - name: print results       
   debug: msg="{{ result }}"

Here's an example for gather fwpolicies which is great if you want to do audits.

tasks:
  - name: get fwpolices from device
   napalm_get_facts:
    username: "{{ admin }}"
    dev_os: 'fortios'
    password: "{{ password }}"
    filter: 'firewall_policies'
   register: resultfwpol  - name: print results
   debug: msg="{{ resultfwpol }}"

A sample output;

A fgt collection play

- name: fgtcollections
 hosts: fgt1
 connection: local  
 gather_facts: no   vars_prompt:
  - name: password
   prompt: "password please"
  - name: admin
   prompt: "username please"
   private: no tasks:                   
  - name: get facts from device      
   napalm_get_facts:          
    username: "{{ admin }}"        
    dev_os: 'fortios'        
    password: "{{ password }}"      
    filter: 'config'        
   register: result          - name: print results       
   debug: msg="{{ result }}"      tasks:
  - name: get fwpolices from device
   napalm_get_facts:
    username: "{{ admin }}"
    dev_os: 'fortios'
    password: "{{ password }}"
    filter: 'firewall_policies'
   register: resultfwpol  - name: print results
   debug: msg="{{ resultfwpol }}"  tasks:
  - name: get interface_counters from device
   napalm_get_facts:
    username: "{{ admin }}"
    dev_os: 'fortios'
    password: "{{ password }}"
    filter: 'interfaces_counters'
   register: counters  - name: print results
   debug: msg="{{ counters }}"

You can do a host of items if supported in the  napalm module but napalm is limited. 

The fortios API is a better approach since it's documented very well and has a host of options for add/delete/change of configurations pieces.

YMMV

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

Postquantum Security IKEv2 PPK fortios

 In this blog you will see a simple PPK deployment to ensure PSK are not crackable. 

1st PPK is a IKEv2 feature

2nd you can make it option or mandatory in the fortios . This allows for a simple PSK and the choice of enforcing PPK

here's the fgt1 cfg

the 2nd fgt is exactly the same in this the fgt1 is a dynamic-ipsec peer

To verify PPK was used run the "diag vpn ike gateway" cmd from cli

To craft a strong ppk-secret is suggest 64 characters or more. Openssl or python can be used for this. Just make it random.

or

$ cat ran.py

import random

import string

ppk = [random.choice(string.ascii_letters + string.digits) for n in xrange(64)]

str = "".join(ppk)

print str

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \