Packet Sniffers, Traffic Counters and NP2 Accelerated Ports

After switching from a FG800 platform (non accelerated network ports) to a 310B (NP2 accelerated ports) I noticed that the "diag sniffer packet" command is no longer very useful.

• Packets are only displayed on the first pass through the firewall. Subsequent packets appear to be "flowed" and not displayed by the sniffer.
• IP addresses are incorrect in certain cases. The sniffer shows packets as originating from the firewall's IP address. When performing a packet capture on the target host the source is that of the original sending host, so a discrepancy there.
• The traffic counters in the firewall policy screen no longer show accurate values. We are receiving several gigs of log traffic through the firewall per day but after several weeks of uptime the counter only displays ~250 MByte of traffic. 
• SNMP statistics do not show correct values due to fastpathing of packets

Solution:

For troubleshooting purposes and when it is desired to capture packets or check the flow on the FortiGate, you can bypass H/W acceleration with the following command on a specific port.

Be aware that this might affect performance and should only be used for troubleshooting purpose.

 "diagnose npu np2 fastpath-sniffer enable port(s)_number"

This now shows all traffic for all sessions to/from this or those port(s) when using the sniffer or the diag debug flow commands

The command below will re-enable H/W offloading :

 "diagnose npu np2 fastpath-sniffer disable port(s)_number"

Note that this is not saved in the configuration and will be lost after a reboot. 

(From Fortinet Knowledge Base) 

Software Updates

FortiOS

• 4.0 MR2 Patch 1, Build 279

 Fortigate-One

• 4.0 MR2 GA, Build 272

 FortiAnalyzer

• 4.0 MR1 Patch 5, Build  138

 FortiClient

•  4.0 MR2 GA, Build 250

 FortiManager

• 4.0 MR2 Patch 1, Build  348

 FortiMail

• 4.0 GA Patch 3, Build 130

 FortiWeb

• 4.0 GA Patch 2, Build 211

FortiAP

• 4.0 MR2 GA, Build 106

Fortigate 800 DIY

What do you do if you shut down your Fortigate 800 and it won't come back on? What if this firewall provides critical Internet access? What if the power supply on the firewall is dead?

Easy, as per the attached pictures (and no, don't try this at home kids :).

Required Ingredients:

• Fortigate 800
• Old PC
• Various tools such as screwdrivers and pliers

Proceed as follows:

• Open Fortigate 800
• Remove power supply from old PC
• Disconnect built-in power supply of Fortigate
• Position old PC power supply next to Fortigate 800
• Connect old PC power supply to Fortigate

And voila it works :)

Blocking Facebook Social Plugins

Here is an interesting blog post from Fortinet on how to block the new Facebook Social Plugins via FortiOS Application Control. The article is here: http://blog.fortinet.com/facebook-social-plugins-world-domination/