HOWTO:Decode PreSharedKeys Juniper SRX

In junos they have a great feature.


To decrypt a configured  pre-shared-key,  you only need to apply the  hash with the request system decrypt.

This works great if you have pre-existing  ipsec-configurations , and you  mis-placed or don't want to  re-key a vpn tunnel.

or if a sec-engineer leaves the company and fails to document the PSK for vpn-tunnels.



e.g

A fortigate for example , does not have this feature.

So unless your fortigate is peer'd with a linux-swan, cisco asa or juniperSRX, you  have almost a zero% chance of  decoding the share PSK.

This also make the fortiOS superior in protection of  the "PSK",  since it  can't easily be decode base on just a  interception of a  fortios conf file.

So when passing JuniperSRX cfg files around, you want to redact the  PSK values.



Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

HOWTO activate 5gig thruput ASR1001X

The cisco ASR 1001X is a pay-as-you-go/grow  device. To use the evaluation license ,  you need to  1st accept the  EULA aggreement.


     config t
      license accept end user agreement

You will be prompt a YES or NO


next you  can validate current  thru-put ( default is 2.5gbps )

      show platform hardware thruput level

ASR01#show platform hardware  throughput level The current throughput level is 2500000 kb/s

Now to  change the thru-put level;

 ASR01(config)#platform hardware throughput level 5000000

% The config will take effect on next reboot

  ASR01(config)#


And then yo can reboot the device. Cisco will display a few warnings and status b4 you  reload.

ASR01#reload

The following license(s) are transitioning, expiring or have expired.

Features with expired licenses may not work after Reload.

Feature: interface_10g                  ,Status: transition, Period Left: 1  wk  2  days

Feature: throughput_5g                  ,Status: transition, Period Left: 8  wks 4  days

Proceed with reload? [confirm]^C





 Felix, Ken 

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

Juniper SRX and Pulse client dialup

The Small-Branch models of the Juniper SRX appliances, typically  comes with two vpn licenses. You can easily set the  SRX up for ipsec-dialup access  for  remote-access.


The JWEBwebgui wizard does a good job & with building a simple/effective dialup-profile and for  local-accounts.

Here's the  final junOS  cli cfg details that seems to work best  with  pulse-client


IKE phase1 using the standard-proposl dhgrp2-aes128-sha1

set security ike policy ike_pol_wizard_dyn_vpn mode aggressive
set security ike policy ike_pol_wizard_dyn_vpn proposal-set standard
set security ike policy ike_pol_wizard_dyn_vpn pre-shared-key ascii-text KEEPITSECURED
set security ike gateway gw_wizard_dyn_vpn ike-policy ike_pol_wizard_dyn_vpn
set security ike gateway gw_wizard_dyn_vpn dynamic hostname GROUPIDHERE
set security ike gateway gw_wizard_dyn_vpn dynamic connections-limit 50
set security ike gateway gw_wizard_dyn_vpn dynamic ike-user-type group-ike-id
set security ike gateway gw_wizard_dyn_vpn external-interface ge-0/0/0.0
set security ike gateway gw_wizard_dyn_vpn xauth access-profile remote_access_profile
set security ike gateway gw_wizard_dyn_vpn version v1-only



IPSEC phase2 using the standard-proposl dhgrp2-aes128-sha1 and w/PFS

set security ipsec policy ipsec_pol_wizard_dyn_vpn perfect-forward-secrecy keys group2
set security ipsec policy ipsec_pol_wizard_dyn_vpn proposal-set standard
set security ipsec vpn wizard_dyn_vpn ike gateway gw_wizard_dyn_vpn
set security ipsec vpn wizard_dyn_vpn ike ipsec-policy ipsec_pol_wizard_dyn_vpn
set security dynamic-vpn clients wizard-dyn-group ipsec-vpn wizard_dyn_vpn


set security dynamic-vpn access-profile remote_access_profile
set security dynamic-vpn clients wizard-dyn-group remote-protected-resources 10.1.1.0/24
set security dynamic-vpn clients wizard-dyn-group ipsec-vpn wizard_dyn_vpn
set security dynamic-vpn clients wizard-dyn-group user socpuppets

set access profile remote_access_profile client socpuppets firewall-user password  mypasswordhere
set access firewall-authentication web-authentication default-profile remote_access_profile

set access profile remote_access_profile address-assignment pool dyn-vpn-address-pool

set access firewall-authentication web-authentication default-profile remote_access_profile


     You need to ensure that the IKE service is allowed  & on the untrusted interface or where the  vpn-clients will connect on. if you get any log message of "no response" than 99.99% of the time it's due to the firewall-engineer forgetting to enable IKE.

e.g

set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ike



The wizard will also set a fwpolicy that you can later modified with the "services" you want


set security policies from-zone untrust to-zone trust policy policy_in_wizard_dyn_vpn match source-address any
set security policies from-zone untrust to-zone trust policy policy_in_wizard_dyn_vpn match destination-address any
set security policies from-zone untrust to-zone trust policy policy_in_wizard_dyn_vpn match application any
set security policies from-zone untrust to-zone trust policy policy_in_wizard_dyn_vpn then permit tunnel ipsec-vpn wizard_dyn_vpn



After a client connects,  you  can validate the  Phase1/Phase2 Security-Associations  details.


e.g

The NCP remote-client-access is very similar btw.



Ken    Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

WEBSITE test and optimizations checks

I'm working with web-devlopers who always seem to have issue.


A few online   sites exist that provided great site checks

1st up,

webpagetest. It's a must for validation of your public site &  if it's reachable. As a pro, you can also  selected various regions and browser types  to simulate browser or movil-types.

http://www.webpagetest.org/


2nd,
google has a simple developer tester with suggestion. It's gear'd for optimization and fix very common & simple problems

https://developers.google.com/speed/pagespeed/insights/?url=


3rd,

Why no  padlock, this should simple to understand and explains simple https-web security issues & with suggestions.

https://www.whynopadlock.com

or

 SSLchecker

https://www.sslchecker.com/insecuresources


KenFelix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

juniper SRX cli benefits over Fortinet FortiOS

In this blog, I will hash out a few  cool functions in junos  that the SRX offers  &  when compared to the Fortinet FortiGate.


1st up  the fortiOS paging  is set from  the config sys console  setting  and  is not per-user-session. Junos allows for you to turn the  paging on per-user-session and not globally.


2nd,  system  junos is really unix ( bsd )  & we actually have  a history cmd option so we can quickly find and repeat previous commands

3rd, the kron scheduler is also native unix. So execution of  a task(s) and or function can be completed with ease and at a schedule date in the future.

4th, if have you have to  delete numerous  firewall.address.objects in fortiOS? Will  if your objects are  similar,  you could do a wildcard delete

5th, show commit detail before you commit. Commits in junos are like IOS-XR, you can actually  review all commit-changes &  before committal

6th, you  can display the  cli configuration in  various outputs that are formatted better or  for parsers
examples json  xml set

show configuration | display xml    
show configuration | display set
show configuration | display json

7th, you  can string match multi-expressions

kfelix@srxappliance> show system services dhcp pool 10.0.0.0/23 detail | grep Add | grep ssign
    Addresses assigned         49/482


next,  you can use  the interface-ranges if you need cover a range of interfaces. This is great if you need to mass-blast  configurations to  range of interfaces or look at a range of interface


I still think the fortigate is one of the best firewall on the market btw. The cli cmd options are slightly  less intuitive imho.

Ken

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

CN and Subject Alternative Names in SSL/TLS certificates

In this post I will show you why the  CN is not very import if you are using  SubjectAltNames.

Most browsers ( chrome, Opera, vivaldi ,  FF ) do NOT  care about the subject line CN if the certificate is a SAN certificate

Take this SelfSigned  certificate for various web  1plus1eq2.com. It has the following alt.Names installed in the certificate.











  Take note of the duplicate  alternate btw  ;) 

This  certificate when load against a web_site,  and once enabled will load with no  certificate error when using any one of the alternate which is all good and normal.

The CN for the certificate was simply labeled as " tstupidcname"

Alt.Name

chrome

firefox

vivaldi

Safari

If you  try to load the site and use the CN & with firefox for example, it will throw a error and even tell you want the certificate protects the sites listed in the Alt.Name sections.

cool ;)

So what you need to understand,  that any issued  x.509v3  certificate that has the Alt.Name extensions, " the web browser will ignore the  CN field in the subject line and will NOT fallback to that CN "

Chrome also  exhibits a error also if you try to use the CN;

But look here; Safari10.1.2 loads the sites with no error when using the CN

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

MACOSX fortigate dialup proposal

Here's a few screenshot of  the dialup proposal that macosx 10.10.x needs in order to use the builtin-cisco client

and here's the wizards details;

AES256 hash; sha1 SHA256 or md5

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \