Forticlient vs Globalprotect differences

 In this blog I will discuss a few items that different  between FTNT and PANW with regards to VPN clients

1: GlobalProetct uses a portal with a list of various gateways. The gateways are where your SSL or IPSEC VPN clients are terminated to. So think of it as a distributed gateway

Fortinet is manual you have to define each gateway

2: With Globalprotect if you need to use a radius server that is not using the MGMT interfaces and have defined local admins authentications with an existing radius server, you can have service for radius using a data plane interface

For Fortinet you can source the radius server from any interface 

3: GlobalProtect does not support Linux/Chrome/mobile devices without a license for globalprotect gateway

FortiGate does not care it supports numerous clients with no additional license

4: GlobalProtect SSL VPN client does not support DTLS

Forticlient, SSLvpn can use TCP or UDP

5: Globalprotect has a fallback from IPSEC ( default ) to SSL if the former has quality issues

Forticlient has no dual-mode fallback

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

CHKP proxy-id narrowing IKEv2

With CHKP and VPN, your Traffic Selectors will be narrowed down to longer CIDR if the peer sends a longer CIDR length 

The following ;

If the peer sends a 10.88.204.0/27 or 10.88.204.73/32 the Checkpoint will negotiate and install an IPsec Security Association for the more specific destination

Fortigate does the same thing btw but it will display the following "Dynamic proxyid as a result of selector narrowing" 

The checkpoint appliance just does not make it so obvious that narrowing has taken place.

This process typically does not issues unless traffic exiting is using the wrong SPI. You will see issues in a lot of firewall Forcepoint and checkpoint primarily where the traffic is exiting using the wrong SPI. You can easily find the SPI used by using a packet size of 666 as an example and capture the ESP datagram on exit and review the SPI #

tcpdump -nnvv -i wan proto 50 and less 790 and greater 666

And on a host generate a ping of 666 bytes { ping -s 666 x.x.x. }

The ESP datagram will stick out and you can verify the SPI value in hex to the IPsec SA.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

sonicwall VPN types ( site 2 site or tunnel )

We will look at the differences

1. 1st tunnel interface means exactly that you have a tunnel and will need a route or use a routing protocol. 
2. This is a classic junos route-based type
3. the proxy-id will be a single 0.0.0.0/0 for src/dst subnets

A policy-based VPN will look similar to the following;

1.  The proxy-id would be whatever remote/local subnets that you define
2. Your policy will initialize the IPsec tunnel, think of a juniper policy-based VPN

In both cases, you still need a firewall policy to allow the traffic flow

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

Panorama and PA devices not receiving templates/devicegroups

 Have you ever had this scenario?

and

Nine out of 10 times you didn't associate the device to the correct devicegroup .

It's always important to make sure the deviceid is associated to the correct tmpl/devgrp

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

What chatGPT says about the top firewalls

 Title: Exploring the Top Firewalls: Enhancing Network Security

Introduction: In today's interconnected world, where cybersecurity threats are increasingly sophisticated, implementing robust network security measures has become paramount. Among the essential components of a comprehensive security infrastructure, firewalls play a crucial role. Firewalls act as a protective barrier between internal networks and external threats, filtering and monitoring network traffic to prevent unauthorized access. In this blog, we will explore some of the top firewalls available in the market, renowned for their features and effectiveness in safeguarding networks.

1. Cisco ASA: Cisco ASA (Adaptive Security Appliance) is a widely recognized and trusted firewall solution known for its advanced threat protection capabilities. It offers a broad range of features, including stateful packet inspection, intrusion prevention system (IPS), virtual private network (VPN) support, and application visibility and control. Cisco ASA provides granular control over network traffic and offers options for scalability, making it a popular choice for small to large enterprises.

2. Palo Alto Networks Next-Generation Firewall: Palo Alto Networks has established itself as a leader in network security, and their Next-Generation Firewall (NGFW) is highly regarded for its innovative approach to threat prevention. It combines traditional firewall functionality with advanced features such as application-aware security, user identification, and content filtering. Palo Alto firewalls leverage machine learning and artificial intelligence to detect and prevent sophisticated threats, making them an excellent choice for organizations focused on proactive security measures.

3. Fortinet FortiGate: Fortinet's FortiGate firewall series is widely deployed across various industries due to its comprehensive security capabilities and high-performance architecture. FortiGate firewalls offer a wide range of security features, including intrusion prevention, web filtering, application control, and sandboxing. They are known for their centralized management system, allowing administrators to efficiently monitor and control network security policies across multiple devices.

4. Check Point Next Generation Firewalls: Check Point is a leading provider of network security solutions, and their Next Generation Firewalls (NGFWs) are renowned for their robust security features. Check Point firewalls offer threat prevention capabilities such as application control, antivirus, URL filtering, and sandboxing. Their unified security management platform allows for simplified administration and comprehensive visibility into network traffic.

5. Juniper Networks SRX Series: The Juniper Networks SRX Series of firewalls combines traditional firewall functionality with advanced threat prevention capabilities. They offer features such as deep packet inspection, application identification, and virtualization support. Juniper firewalls provide flexible deployment options and are known for their high-performance architecture, making them suitable for networks with demanding security requirements.

Conclusion: Selecting the right firewall for your organization is crucial to ensuring robust network security. The firewalls mentioned above, including Cisco ASA, Palo Alto Networks Next-Generation Firewall, Fortinet FortiGate, Check Point Next Generation Firewalls, and Juniper Networks SRX Series, are among the top choices available today. Each firewall solution brings its unique set of features and strengths to the table. It's important to consider factors such as the organization's security requirements, scalability, ease of management, and integration capabilities when making a decision. By implementing a reliable firewall solution, organizations can strengthen their network defenses and protect sensitive data from ever-evolving cyber threats.

Simple PANOS api examples

The REST-api or XML-api is very simple to use. I'm going to show you a few examples.

1st with RESTapi you have to call your API-KEY as a header "X-PAN-KEY: biglogapikey". 

tip:

You have to specify the API version also. if you specify the wrong version you will received a error similar to;

:[{"code":1,"module":"panui_restapi","description":"Version Not Supported: v10.1"}]}]}%

tip:

If you have typos , the key will not work

tip:

Do not add the key as a HTTP query string 

examples;

restapi

# retrieve all objects from fw

curl -H "X-PAN-KEY:LUFRPT1zQ05XOHhPbXpFWk9GWTVFcXVaMkhDVTY4dEE9bFg3VnFtc3RlSGN1L1U2eGd1bVA3NGJRN0wwaUxkcEZVVlYvN1o5VTZ6cklsRi9QZjA4NEhqc1NkblJqd3FROQ=="  -k "https://192.168.11.99/restapi/v10.0/Objects/Addresses?location=vsys&vsys=vsys1"

# all services

curl -H "X-PAN-KEY:LUFRPT1zQ05XOHhPbXpFWk9GWTVFcXVaMkhDVTY4dEE9bFg3VnFtc3RlSGN1L1U2eGd1bVA3NGJRN0wwaUxkcEZVVlYvN1o5VTZ6cklsRi9QZjA4NEhqc1NkblJqd3FROQ=="  -k "https://192.168.11.99/restapi/v10.0/Objects/services?location=vsys&vsys=vsys1"

# addressGroups

curl -H "X-PAN-KEY:LUFRPT1zQ05XOHhPbXpFWk9GWTVFcXVaMkhDVTY4dEE9bFg3VnFtc3RlSGN1L1U2eGd1bVA3NGJRN0wwaUxkcEZVVlYvN1o5VTZ6cklsRi9QZjA4NEhqc1NkblJqd3FROQ=="  -k "https://192.168.11.99/restapi/v10.0/Objects/AddressGroups?location=vsys&vsys=vsys1"

# security polices

curl -H "X-PAN-KEY:LUFRPT1zQ05XOHhPbXpFWk9GWTVFcXVaMkhDVTY4dEE9bFg3VnFtc3RlSGN1L1U2eGd1bVA3NGJRN0wwaUxkcEZVVlYvN1o5VTZ6cklsRi9QZjA4NEhqc1NkblJqd3FROQ=="  -k "https://192.168.11.99/restapi/v10.0/Policies/SecurityRules?location=vsys&vsys=vsys1"

# NAT rules

curl -H "X-PAN-KEY:LUFRPT1zQ05XOHhPbXpFWk9GWTVFcXVaMkhDVTY4dEE9bFg3VnFtc3RlSGN1L1U2eGd1bVA3NGJRN0wwaUxkcEZVVlYvN1o5VTZ6cklsRi9QZjA4NEhqc1NkblJqd3FROQ=="  -k "https://192.168.11.99/restapi/v10.0/Policies/NatRules?location=vsys&vsys=vsys1"

# zones

curl -H "X-PAN-KEY:LUFRPT1zQ05XOHhPbXpFWk9GWTVFcXVaMkhDVTY4dEE9bFg3VnFtc3RlSGN1L1U2eGd1bVA3NGJRN0wwaUxkcEZVVlYvN1o5VTZ6cklsRi9QZjA4NEhqc1NkblJqd3FROQ=="  -k "https://192.168.11.99/restapi/v10.0/Network/zones?location=vsys&vsys=vsys1"

The XML-API can use the key within a http query string, just append it to the HTTP get query.

xml-api

#list devices XPath

 curl  -k  'https://csockets-panorama01.socpuppets.net/api/?type=op&cmd=<show><config><running><xpath>devices</xpath></running></config></show>&key=LUFRPT1wWno4WEprSHlqV1hkNGtuWllXckxXaVFtOWM9a0ZmdTlKMFQxZWRVMVhkd29pSVlqZU1JL2UvcVF6L1AvbmZKYUR3Yi8xeXdkS0XnedRscXk2Z043OWJMbEtpdw=='

# list shared xpath

curl  -k  'https://csockets-panorama01.socpuppets.net/api/?type=op&cmd=<show><config><running><xpath>shared</xpath></running></config></show>&key=LUFRPT1wWno4WEprSHlqV1hkNGtuWllXckxXaVFtOWM9a0ZmdTlKMFQxZWRVMVhkd29pSVlqZU1JL2UvcVF6L1AvbmZKYUR3Yi8xeXdkS0XnedRscXk2Z043OWJMbEtpdw==' 

# check operational mode

curl  -k  'https://panorama01.socpuppets.net/api/?type=op&cmd=<show><operational-mode></operational-mode></show>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

# fetch license

curl  -k  'https://panorama01.socpuppets.net/api/?type=op&cmd=<request><license><fetch/></license></request>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

curl  -k  'https://panorama01.socpuppets.net/api/?type=op&cmd=<request><license><info/></license></request>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

# display the license details

 curl  -k  'https://panorama01.socpuppets.net/api/?type=op&cmd=<show><system><info></info></system></show>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

# save the config file

curl  -k  'https://panorama01.socpuppets.net/api/?type=op&cmd=<save><config><to>config.save</to></config></save>&key=LUFRPT1lL0I0YkFhMFNIOUs1SDSiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVXVyV21YREFSeFFnZmFXVzUrb0luZw=='

here's an example of a license info

XML is sometimes slightly harder but you have multiple items that can be done from show operational and commit commands.

RESTapi is easier but if you ever upgrade your FW and have hardcoded scripts, the API version will come back and haunt you.

I've always found myself using a combination of REST and XML API calls.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

HOWTO Backup Panorama with a API call

 One of my colleagues was discussing a way to backup panorama cfg vrs with the "schedule backup export" option that Palo has.

The problem with Scheduled Config Export the save file does not have the time stamps in the name

By using the API you can set the timestamp  by using the date cmd

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/pan-os-xml-api-use-cases/query-a-firewall-from-panorama-api

e.g 

create the API key

curl -k -X GET 'https:///panorama.socpuppets.com/api/?type=keygen&user=kfelix&password=ChangeME2023%21%40%23'

run the API call every hour and download the file

curl -o panorama.`date +%F-%H-%M-%S`.xml -k  'https://panorama.socpuppets.com/api/?type=op&cmd=<show><config><running><%2Frunning><%2Fconfig><%2Fshow>&key=LUFRPT1lL0I0YkFhMFNIOUs1RDRiUFFBVDAvOXdxNjQ9WmNaa1JrblVuMEVubFBBNlVJT3loWk9VT0F5VThiK0s1UmFjTVhwa0oyVJJyV21YREFSeFFnZmFXVzUrb0luZw=='