fortinet beta v5.4 is out

That's quick , our folks at FTNT has now release the latest beta and actively encouraging end-users involvement. If you review this previous post, than you can learn more about  FTNT beta program.
http://socpuppet.blogspot.com/2014/11/a-look-at-fortinet-beta-program.html

So now with  v5.4 and if you have a licensed item(s), you can part take of testing and providing feedback. It also allows you 1st insight and a glance/peek at new features that FTNT plans to offer.

The beta programs stays open until a release candidate has been qualified. This could  take a few months to get to that point. At this point, the beta doors are closed and our main-stream release under the version is now general available to users with support contracts.

The beta program is very unique to FTNT and almost nobody else has anything similar from my review & knowledge


http://beta.fortinet.com/

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

finally ikev2 PANOS 7.0.0

I was looking the release notes over a few days ago and  PANOS 7.0.0 has ikev2 support.

So what this means, now I can enable  ikev2 within all of my vpn to just about every other firewall vendor without  worrying about compatbility.

It's time for upgrades;)

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

ipv4 allocation updates

I 'm researching some stuff about ipv4 allocation and found the following link;

http://www.potaroo.net/tools/ipv4/

With ipv6 allocations is more uniform and equally balanced between RIRs.

Regional Internet Registery
APNIC	Asia Pacific
AFRINIC	Africa
ARIN	USA, Canada, Caribbean and North Atlantic islands,
LACNIC	Latin America and the Caribbean
RIPE NCC	Europe, the Middle East, and parts of Central Asia

 http://www-public.it-sudparis.eu/~maigron/RIR_Stats/

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

disktest fortiOS

If you suspect a bad disk, you now have the ability to use the diag disktest command under FortiOS to  validate the disk integrity

You can set the number , size, and cycles to run.

e.g
  SOC60D (global) # diag disktest dev 1
  Current Test Device: /dev/sda

  SOC60D (global) # diag disktest time 120
  Current Time Limit: 120 seconds

  SOC60D (global) # diag disktest size 2
  Current Size Limit: 2 MB

  SOC60D (global) # diag disktest run
 
The unit will run unlimited cycles,  unless you specify the  # of cycles using the following;

   diag disktest run <insert  # of cycles )

All tests will run  unless cancel  the test cycle early. It best to execute  this command during low usages. I never was able to  execute this against any  usb-thumb-drives.

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

macosx ipsec client nat-keepalive validation

You can take a packet capture of traffic from  your macosx client, and by reviewing the timestamps you can check and validate the keepalive intervals for NAT-T.

In this example, my vpn-concentrator is located at 192.0.2.1 & the macosx client KAs are at a 20sec interval.

The KAs will ensure the firewall doesn't close the UDP sessions from the connections and/or nat-transaction tables.


Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

howto 802.1q tagged subinterfaces for MACOSX

In this post I will show you how to  create tagged  802.1q subinterfaces under MACOSX.

By using the  plumb cmd you can create a subinterface. You could also use create just as equally. The cmd is simple and require the word vlan and not just any name

note: take notice that the subinterface mtu will be reduced due to the 4bytes overhead for 802.1q. This will be based off the physical interface MTU.

 To remove a interface, just unplumb it.

That's how simple and the few simples steps required for 802.1q tagging and MACOSX.

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

cisco ASA 9.4.1/9.3.1 woes

I ran into a  few problem with a ASA 5558-X reading a simple USB disk undre 9.3.1.

 Here's a  ASA 9.4.1 usb-disk and it's filesystem.

9.4.1

9.3.1

The 2nd problem ospf  ospf table was populated with ospf learned routes in another  ASA after we had the cluster split running 9.4.1 and 9.3.1.

************WARNING****WARNING****WARNING********************************
   Mate version 9.4(1) is not identical with ours 9.3(1)
************WARNING****WARNING****WARNING********************************
*****

Funny thing all ospf-routes where in the correct multi-context route table but NO ospf neighbors shown or existed.

note: I'm also running a dual  ospf process between the outside external and inside internal

We had to immediately reboot the  stand-by 9.3.1 cluster to bring it up to 9.4.1 and allow the  2 cisco ASA to re-sync.

That by far was the weirdest issues that I ever  seen during any upgrades. I would have open a cisco TAC ticket, but I'm sure cisco TAC would have just stated to upgrade to 9.4.1 to begin with.

The 9.4.1 upgrade strategy allows you to upgrade to 9.4.1 directly from 9.3x, but I never would have expect the OSPF database to get corrupted.

A upgrade to  9.4.1 fixed the issues.

NOTE: I found a interesting command option that I never knew.
You can query ospf routes per ospf directly by specifying the ospf-process ID

e.g ( proc 44 vrs 45 )


FWMAcontext2/act/FWMAFW1# show  route ospf 44 | inc 0.0.0.0
Gateway of last resort is 192.0.2.17 to network 0.0.0.0
O*IA  0.0.0.0 0.0.0.0 [110/11] via 192.0.2.17, 00:06:29, EXTERNAL02
FWMAcontext2/act/FMAFW1#

FWMAcontext2/act/FWMAFW1# show  route ospf 45 | incl 10.2.2.0
O        10.2.2.0 255.255.255.0
FWMAcontext2/act/FWMAFW1#
 
I hope this helps someone else.  If you don't specify the proc-ID you get ALL ospf route for that context.

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \



Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \