null-routing for PANOS using goBGPD

 Someone asked me to explain how to use gobgpd with palo alto firewalls based off this previous blog that was posted

http://socpuppet.blogspot.com/2022/03/gogogo-gobpd-for-rtbh-injection.html

PANOS has a few pieces that you need to do

1st you need to setup BGP peer in the VR-instance ( default  in my case ) . Make sure to enable the peer and enable installing the routes.

 

It's best to set up a import policy ( optional ), so you can set the next-hop, weight,local-pref

For the next-hop to null, you need a discard route installed.

Make sure you check logs and rib table

For goBGP the configuration is still simple.

[global.config]

    as = 2

    router-id = "0.0.0.2"

    port = 179

[[mrt-dump]]

    [mrt-dump.config]

       # dump-type = "updates"

       #file-name = "/home/gobgpd/dump.dump"

       # dump-interval = 180

       # rotation-interval = 28800

[[neighbors]]

    [neighbors.config]

        peer-as = 1

        # auth-password = "password"

        neighbor-address = "198.206.234.255"

        local-as = 2

For route injection, we will use the typical gobgp global rib cmd

for p in ` cat ip.list  ` ;  

   #

   # ip.list is our ipv4 list of harvest /32 that are to be dropped 

   #

   # this list can be populated from loggers and parsers, outputs from a siems details, or manually created

   do gobgp global rib add $p/32 community 1:999 ; 

done

We are sending bgp-community 1:999, which the import policy uses to set its local_pref and next-hop to the discard.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

      /      \ 

fortiso 7.2.0 is out

 Okay I finally have some time to push some new details and got around in updating my fortios gear. 

https://docs.fortinet.com/document/fortigate/7.2.0/new-features/770045/overview

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

      /      \ 

DUO on checkpoint for remote access tips from vault

Just assisted in a DUO-MFA for vpn clients in a checkpoint DUO MFA setup 

  https://help.okta.com/en/prod/Content/Topics/integrations/check-point-radius-intg-test.htm

I wanted to point out a few items that are easily missed

When setting up the DUO-PRoxy the service port must be relay to the firewall admin. It's typically 1812 or 1645.

Make sure to set the proper SERVICE in your radius object 

When diagnosing connectivity from the checkpoint security gateway, the interfaces that faces the  DUO-PROXY should have a pcap create to witness the traffic, You can always decode the radsniff datagram and see the user details to include password.

Tips

•   if no response ; check service_port ( 1645 or 1812 )  and radius server ip.address
•   if the body of the request has a "chap" challenge you need to convert the radius-client to "PAP"
•   the response for valid logins would be a "Access-Accept" reply 

You can read more here ;

http://socpuppet.blogspot.com/2017/04/securing-fortigate-sslvpn-with-mfa-by.html

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

      /      \ 

JUNIPER SECURITY certification

 My day job has to maintain a few juniper certifications, so I took the JNCIA-SEC exam and pass. The exam should be called juniper ATP since most the exam focus was in ATP.

The believe screenshot shows the exam objectives

One thing I found interesting is the exam did not really have a lot diagnostic or troubleshooting exhibits. Most of the items where straight forward questions & about practical use.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

      /      \ 

GoGoGo goBPD for RTBH injection

 In most big enterprise and MSSP , the need exist for bgp-route-injection  for blackhole. I wrote about a opensource pyhton BGP daemon earlier,  http://socpuppet.blogspot.com/2020/12/using-yabgp-for-blackhole-injection.html. Here is goBGPD which is the next evolution for opensource routing

https://osrg.github.io/gobgp/

goBGPD is another simple means and is great if you want to inject routes. Most of the time we collect C&C and malicious address from IDS from IPS/IDS/SIEM and then run them thru a check and injector the ip.list 

Let's look at a simple configuration file

/* 192.168.1.99 is a FGT firewall fwiw

Now to craft routes,  we can do a simple for loop and read in a list of address from a file

Gobgp has a cli-cmd controller which is simple and mimic the classic legacy Merit gateD  just type gobgp --help to see your options

You can do many of everything, see just a few samples below;

disable and reenable a bgp-peer

monitor actively RIB updates

check our cfg global

If you need to drop ( withdrawn ) a address you can del all or specific prefixes

routes sent is easy just check the adj-out

Or just see bgp-neighbor establishment state

GoBGP has been around for some time and support numerous SAFI and is easy to manage for RTBH or to inject specific /32 into a firewall so uRPF and introduce failure and traffic to or from the firewall will be drop. 

A list of 1000k /32 only took me 9 seconds to advertise via goBGP on a small foot print ubuntu server and a FGT100D

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

      /      \ 

howto send rpc cmd via junos and netconf and ssh

 Within junos you can send cmds from a list via netconf . 1st thing you need to looking at  the display xmk rpc  out for the command and then use that in your file

Here's a "show system interface"  in rpc syntax

supports-MacBook-Pro:~ ken$ cat sys

<rpc>

        <get-system-information>

        </get-system-information>

</rpc>

Here's a "show arp"  in rpc syntax

supports-MacBook-Pro:~ ken$ cat arp 

<rpc>

   <get-arp-table-information/>

</rpc>

 

You could easily just pipe the above redirect into via ssh and netconf the juniper device;

supports-MacBook-Pro:~ ken$ 

supports-MacBook-Pro:~ ken$ cat sys arp  | ssh -6  root@2001:1258:727:12::1 -s netconf

The output will be dump back in xml format;

e.g 

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:junos="http://xml.juniper.net/junos/19.4R3/junos">

<system-information>

<hardware-model>mx104</hardware-model>

<os-name>junos</os-name>

<os-version>19.4R3-S11</os-version>

<serial-number>T623</serial-number>

<host-name>core1.usme</host-name>

</system-information>

</rpc-reply>

]]>]]>

<rpc-reply xmlns="urn

( output snipped ) 

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

      /      \ 

Large bgp community support in FortiOS

 I was working with a group that had fortigate and was not seeing large commnities. So we did some trial and testing and found out the UPDATE had the large community sent but the fortigate drops that community

e.g ( 10.10.10.2 sent standard/extended/large communities ) 

SOCPUPFGT02 # get router info bgp network 10.19.22.0/25

VRF 0 BGP routing table entry for 10.19.22.0/25

Paths: (1 available, best #1, table Default-IP-Routing-Table)

  Not advertised to any peer

  Original VRF 0

  2

    10.10.10.2 from 10.10.10.2 (10.10.10.2)

      Origin IGP metric 1111, localpref 100, valid, external, best

      Community: 1234:1234 1234:1235 5706:1111 65535:0

      Extended Community: RT:64511:1 

      Last update: Thu Mar  3 04:00:40 2022

As you can see, we have no large communities in the list. Support provide the following link that explains what BGP supported RFCs.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

      /      \