FortiClient - RSA New Pin Is Wrong (-7201) error

This message is somewhat misleading.

One of our users was attempting to login to the VPN and their Active Directory password had expired.
When they tried to follow the steps to enter their new password they received the above error message.

The root cause was that the new password they were trying to use did not meet the Active Directory password complexity requirements.

So while the error message itself is pretty generic it appears that this is simply what is returned from the back-end Radius server. Not much the Fortigate can do to further interpret the error.
It would be up to the Radius vendor to send a more descriptive error message.

Problems with FortiClient 7.0.2 and Firefox

 We noticed during recent testing that FortiClient 7.0.2 has an issue with Firefox, specifically any Google services such as Google Search and GMail.

While web-filtering was enabled on the client an initial access to Google would work in Firefox, however after a minute or so nothing would happen when trying to refresh the browser session.

The root cause appears to be related to 0RTT (Zero Round Trip Time) and only affects Firefox but not other browsers. Fortinet has tracked this as bug ID 766869.

The issue is resolved in FortiClient 7.0.3 and a workaround is to disable 0RTT in Firefox using the following procedure:

Firefox browser window:

• about:config
• Search for security.tls.enable_0rtt_data
• set the value to false

FortiClient EMS Cloud Login Problem - Solved

 I noticed today that when you logout from your cloud based FortiClient EMS instance and then try to login again you receive the following error message in Firefox:

{"result": {"retval": 0, "message": "Local signin is not available in EMS Cloud"}} 

 It appears to be a cookie related issue in Firefox. When I delete any cookies in the browser referencing "forticlient" I am able to login normally.
Also, this appears to be limited to Firefox as Chrome works fine, even without messing with the cookies.

Beware - Upgrade to FortiOS 5.6.3+ with IPSec VPNs

If you are upgrading from version 5.4.5, 5.4.6, or 5.4.7 to FortiOS 5.6.3, the IPsec phase1 psksecret setting might be lost. To avoid this, upgrade to FortiOS 5.6.2 and then to 5.6.3. If the psksecret setting is lost, you will need to reconfigure it after upgrading.

Even if you have saved configs you will need to reset the passwords since FortiOS 5.6.3 will not allow you to paste the encrypted passwords from 5.4.x versions.

Ironically Fortinet on their Support site states that the "recommended" upgrade path is from 5.4.5 directly to 5.6.3 - see screenshot below.

Cisco ASA to Fortigate conversion

I'm getting ready to migrate a number of Cisco ASA firewalls to Fortigate.
Fortinet sells a ~$4000 license for their FortiConverter which I didn't want to spend.

My goal was to automate the conversion of objects which will save time and virtually eliminate the possibility of typos.

The below perl script is what I came up with.

-Syntax: "perl converter.pl <ASA config file name>" (e.g. "perl converter.pl running-config.cg")
-Script converts hosts, networks and ip ranges
-Script does NOT convert or create group objects (someone want to add that for me?)

Once run all that's left to do is remove all the miscellaneous Cisco commands, import the config (via GUI or CLI) and within a couple of minutes you have all the objects ready for use in creating policies.

Happy New Year :)


#!/usr/bin/perl

# Requires Net::Netmask module

use strict;
use warnings;
use Net::Netmask;

$^I = '.bak'; # create a backup copy

BEGIN {undef $/;}

while (<>) {
# match host objects in groups
   s/network\-object host ((?:\d{1,3}\.){3}\d{1,3})/config firewall address\redit h-$1\rset subnet $1 255.255.255.255\rnext\rend/g; # do the replacement
 
# match network objects in groups
   s/network\-object ((?:\d{1,3}\.){3}\d{1,3})\s(.*)/"config firewall address\redit n-$1\/".Net::Netmask->new("0.0.0.0", $2)->bits."\rset subnet $1 $2\rnext\rend"/ge;
 
# match host objects with descriptions
   s/object network.*\s*host ((?:\d{1,3}\.){3}\d{1,3})\s*description\s(.*)/config firewall address\redit h-$1\rset comment $2\rset subnet $1 255.255.255.255\rnext\rend/g;
 
# match host objects without descriptions
   s/object network.*\s*host ((?:\d{1,3}\.){3}\d{1,3})/config firewall address\redit h-$1\rset subnet $1 255.255.255.255\rnext\rend/g;
 
# match subnet objects with descriptions
   s/object network.*\s*subnet ((?:\d{1,3}\.){3}\d{1,3})\W(.*)\s*description\s(.*)/"config firewall address\redit n-$1\/".Net::Netmask->new("0.0.0.0", $2)->bits."\rset comment $3\rset subnet $1 $2\rnext\rend"/ge;
 
# match subnet objects without descriptions
   s/object network.*\s*subnet ((?:\d{1,3}\.){3}\d{1,3})\W(.*)/"config firewall address\redit n-$1\/".Net::Netmask->new("0.0.0.0", $2)->bits."\rset subnet $1 $2\rnext\rend"/ge;
 
# match range objects with descriptions  
   s/object network\s.*\s*range ((?:\d{1,3}\.){3}\d{1,3})\W(.*)\s*description\s(.*)/config firewall address\redit r-$1-$2\rset comment $3\rset type iprange\rset start-ip $1\rset end-ip $2\rnext\rend/g;
 
# match range objects without descriptions
   s/object network.*\s*range ((?:\d{1,3}\.){3}\d{1,3})\s(.*)/config firewall address\redit r-$1-$2\rset type iprange\rset start-ip $1\rset end-ip $2\rnext\rend/g;
 
# remove leftover network group names with descriptions
   s/object\-group.*\s*description.*//g;
 
# remove leftover network group names without descriptions
   s/object\-group.*//g;
 
# remove references to existing network objects
   s/network-object object.*//g;

 print; # print to the modified file
}

How-to: Automatically revert a config on a FortiGate

There's nothing worse than remotely configuring a firewall and then loosing access once you've made your changes. Having a failsafe mechanism in place to revert to a previous config automatically will help you minimise potential issues and save you alot of stress! Luckily FortiOS gives you a few options on how to save your running config which we'll discuss below.

We'll go through each of the three options available. Each one is configured via the CLI.

1. Automatic
2. Manual
3. Revert

1. Automatic

This is the default setting. The FortiGate will automatically save it's running config to the start-up config every time you make a change by typing 'end' in the CLI or clicking Ok/Apply in the GUI.

config system global
set cfg-save automatic
end

2. Manual

In Manual mode, your changes will take effect immediately (saved to the running config) but will be lost on a reboot unless a special save command is given (the running config will then be saved to the startup config).

config system global
set cfg-save manual
end

To save your changes to the startup config use the following command:

execute cfg save

3. Revert

Revert mode will start a countdown timer as soon as you've made a change. If you don't save the config before the countdown timer has ended then the unit will automatically reboot and load the startup config (ie: all your changes will be lost).

This is perfect if you're doing remote administration. If you make a change that locks you out, just wait until the timer has restarted then the firewall will reboot with your previous config.

config system global
set cfg-save revert
set cfg-revert-timeout 300
end

The cfg-revert-timeout variable is the countdown timer in seconds. The default is 600 seconds (10 minutes).

To save your changes to the startup config use the following command:

execute cfg save

One word of warning: You will not see any countdown timers via SSH/Telnet or the WebGUI. You can only see these timers if you've connected to the device via console. The countdown starts warning you from 10 seconds, so you need to be quick!


(credit: Al's Tech Corner)

HA Console authentication when using remote Auth

When you login to the CLI via a RADIUS or TACACS account and you then use "exec ha manage 1" to manage the subordinate unit you have to re-enter your user credentials.
I remember seeing this in my TAM days. I'll submit a feature request to have the authentication carried over.

Disable SSL VPN Portal

Here's one for the serious customizer.
If you are wanting to only accept IPSEC VPN connections via FortiClient and you don't want/need the SSL VPN portal here's the CLI config for turning off the SSL VPN page.

config vpn ssl settings
 set sslvpn-enable disable
end 

Wow .. it's been a while :)
Haven't worked at Fortinet since January of this year. But my new gig just invested in Fortinet equipment. So stay tuned for new posts!

HA with different revision hardware

There may come a time when you have rev.1 and rev.2 hardware of a particular platform that you're trying to form an HA cluster with. To successfully accomplish this you need to tell the firewall to ignore the difference in hardware revision.

In FortiOS 4.3 and earlier:
config system global
set ignore-hardware-revision enable
end

In FortiOS 5.0 and later:
exec ha ignore-hardware-revision enable
exec ha ignore-hardware-revision status

More Shellshock Info

FortiGuard Advisory with status of affected products

FortiGuard Shellshock Blog Post

Bash Vulnerability Signatures

The newly announced Bash / Shellshock vulnerability is document in CVE2014-6271.

Here are IPS rules for immediate manual deployment. Fortinet has already generated
a new IPS signature, Bash.Function.Definitions.Remote.Code.Execution, which will be released in the next few hours after it has passed the QA testing process.

Fortigate firewalls do NOT use Bash and are not vulnerable to this exploit. The rules below can be used to filter traffic destined for devices protected by the firewall.

F-SBID( --name "Bash.Code.Execution.Custom1"; --protocol tcp; --service HTTP; --flow from_client; --pattern "|28 29 20 7b 20|"; --context uri; --pcre "/[=?&\x2f]\s*?\x28\x29\x20\x7b\x20/"; --context uri ; )
F-SBID( --name "Bash.Code.Execution.Custom2"; --protocol tcp; --service HTTP; --flow from_client; --pattern "|28 29 20 7b 20|"; --context header;)
F-SBID( --name "Bash.Code.Execution.Custom3"; --protocol tcp; --service HTTP; --flow from_client; --pattern "|28 29 20 7b 20|"; --context body; --pcre "/(?:^|[=?&])\s*?\x28\x29\x20\x7b\x20/"; --context body ; )
F-SBID( --name "Bash.Code.Execution.Custom4"; --protocol tcp; --service HTTP; --flow from_client; --pattern "()"; --context header; --pattern ":|3b|"; --context header; --within 8; --pattern "}"; --context header; --within 8; --pcre "/(Cookie|Host|Referer):\s*\(\)\s*\{\s*:\x3b\s*\}\s*\x3b/i"; --context header; --distance -32; --within 128; )

Switching interface modes

By default smaller Fortigate units such as the 60D or 90D series combine their interfaces into a virtual switch. Via a configuration change all ports can be assigned to their own broadcast domains. This is useful for example if you want to configure a number of different trunk ports.

By default the firewalls are also configured with basic policies that permit and NAT outbound traffic as well as a DHCP server. These configurations need to be cleared before the switch mode can be changed.

#config firewall policy
#purge

This operation will clear all table!
Do you want to continue? (y/n) y

#end
#config system dhcp server
#purge

This operation will clear all table!
Do you want to continue? (y/n) y

#end
#config system global
#set internal-switch-mode interface
#end

Changing switch mode will reboot the system!
Do you want to continue? (y/n) y

Silence of the Local Broadcasts

When setting up a new FortiGate you tend to receive a lot of logs for traffic destined to 255.255.255.255 (aka the global broadcast address) or x.x.x.255 (your local subnet broadcast address). To reduce clutter and have the firewall drop these broadcasts silently use:

FortiAnalyzer:
config log fortianalyzer filter
    set local-traffic disable
end

Log Disk
config log disk filter filter
    set local-traffic disable
end

Memory:
config log memory filter
    set local-traffic disable
end

Syslog
config log syslogd filter
    set local-traffic disable
end

New Feature Highlight: Dedicated Management CPU

In FortiOS 5.2 and higher you can dedicate one of the CPUs for management access, in other words GUI and CLI access. If the system is running under extremely high loads this will guarantee access to management functions.

This feature is available in 2U firewalls and blades only that have multiple CPUs.

To enable this feature (default disabled):

conf system npu
    set dedicated-management-cpu <enable | disable>
end

Fortinet Diagnostic WIKI

Very useful resource for diagnostic commands.

http://wiki.diagnose.fortinet.com:1080/index.php/Overview

Exporting a local certificate with private key

If you have a local certificate on the Fortigate and the original certificate request (csr) was generated on the Fortigate then the private key resides on the Fortigate and you need to export this in order to install your signed certificate on another server.
The problem with the Fortigate certificate export feature is that it will only export the signed certificate (which you likely already have stored somewhere). The private key is stored in the configuration backup file however it is encrypted with an unknown password.
Luckily there is a workaround available, you can unset the private key password via CLI then back up your configuration file where you’ll find the private key available for use.

config vpn certificate local
show

This will give you a list of the local certificates. Next edit the desired certificate and unset the password

edit testcert
unset password
end

Now when you back up your Fortigate configuration you’ll find the signed certificate as well as the private key.

Look for the following line:

set private-key "-----BEGIN RSA PRIVATE KEY-----

Copy everything between (and including)

-----BEGIN RSA PRIVATE KEY-----
and
-----END RSA PRIVATE KEY-----

into a text file.. This is your private key that can be used with the signed certificate to be imported into another server.

("Borrowed" from http://stuff.purdon.ca/?page_id=233)

Heartbleed - Part 3

Anyone running FortiOS 5.0 GA to 5.0.6 can protect the firewall itself by

• limiting access to the firewall's Admin interface using "Trusted Hosts" in the Admin profiles

or

•  configuring an interface policy as per below

config firewall interface-policy

    edit 1
        set interface "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set service "HTTPS"
        set ips-sensor-status enable
        set ips-sensor "opensslheartbeat"
    next

end

Heartbleed - Part 2

Here is some more information from FortiGuard
http://www.fortiguard.com/advisory/FG-IR-14-011/

Exporting firewall rules to a CSV

Sometimes it can be useful to export and analyze rules in a CSV type format. This comes in especially handy when working with long and complex firewall policies.

I came across the perl script below that takes firewall policies from a text file and performs the CSV conversion for you.

Syntax: csvparse.pl rules.txt

<rules.txt> should be in the following format:

config firewall policy
     edit 1
         set srcintf "internal"
         set dstintf "wan1"
             set srcaddr "all"
             set dstaddr "all"
         set action accept
         set schedule "always"
             set service "ANY"
         set logtraffic-app disable
         set webcache enable
         set nat enable
     next
end

And here's the Perl script.

#!/usr/bin/perl
#

my $output = "policies-out.csv";

my $policyid = 0;
my $setting = "";
my %policies;
my %seen;
my $in_policy_block = 0;
my @order_keys;
my $order_key = 0;

open(OUTFILE,">$output") || die "Can't open file $output: $!\n";

while (<>) {
	if ($in_policy_block) {
		if (/^\s*edit\s+(\d+)/i) {
			# start of new policy
			$policyid = $1;
		} elsif (/^\s*set\s+(\S+)\s+(.*)$/i) {
			# it's a setting
			my ($key,$value) = ($1,$2);
			$value =~ tr/\"\015\012\n\r//d;
			$order_keys[$order_key++] = $key unless $seen{$key}++;
			$policies{$policyid}{$key} = $value;
		} elsif (/^\s*end/i) {
			$in_policy_block = 0;
		}
	} elsif (/^\s*config firewall policy/i) {
		$in_policy_block = 1;
	}
}

# print out our header
print OUTFILE "id";
foreach my $key (@order_keys) {
	print OUTFILE ",$key";
}
print OUTFILE "\n";

# now print out each record
foreach my $policy (sort keys %policies) {
	print OUTFILE "$policy";
	foreach my $key (@order_keys) {
		if (defined($policies{$policy}{$key})) {
			print OUTFILE ",$policies{$policy}{$key}";
		} else {
			print OUTFILE ",";
		}
	}
	print OUTFILE "\n";
}


close(OUTFILE);