If you have seen your firewall CPU utilization go to 100% and stay there my recommendation is to NOT upgrade to FortiOS 3.0 MR6 Patch 2 at this time. Where before the firewall would continually run high CPU utilization it did not appear to affect traffic. After the upgrade to MR6 Patch 2 traffic is now being impacted. The firewalls will still pass ICMP but services such as http, snmp and others are being effectively blocked. See my June post about further details and how to temporarily work around the problem.
*** Update ***
Fortinet Engineering has confirmed this as an infinite loop problem in the IPS Engine triggered by DCE/RPC type traffic. In 3.0 MR5 the impact was not noticeable. In 3.0 MR6 the IPS engine has a higher priority which is why traffic is now affected.
** Update to the previous Update **
Fortinet Engineering has fixed the issue. The new IDS package 1.097 should take care of it.
Monday, July 21, 2008
Friday, July 18, 2008
Deny Rules are counter intuitive in 3.0 MR6
Say you want to block traffic from a known bad IP on the Internet to all systems on your DMZ. All machines in the DMZ are natted to the outside world using Virtual IPs. Generally you would expect to create a rule like this:
From: External, IP address of bad external system
To: DMZ, Any
Action: Deny
In 3.0 MR6 (and potentially other versions) this does not work. You have to block traffic to specific NAT addresses. The fastest way to do this is to create a VIP Group under Firewall -> Virtual IP -> VIP Group and add all your natted addresses to the group, let's call it "All NAT" for example. You would then build the following rule:
From: External, IP address of bad external system
To: DMZ, "All NAT"
Action: Deny
As per the official response from Fortinet this is working as designed and is not a bug.
From: External, IP address of bad external system
To: DMZ, Any
Action: Deny
In 3.0 MR6 (and potentially other versions) this does not work. You have to block traffic to specific NAT addresses. The fastest way to do this is to create a VIP Group under Firewall -> Virtual IP -> VIP Group and add all your natted addresses to the group, let's call it "All NAT" for example. You would then build the following rule:
From: External, IP address of bad external system
To: DMZ, "All NAT"
Action: Deny
As per the official response from Fortinet this is working as designed and is not a bug.
Labels:
configuration examples,
fortigate
Wednesday, July 16, 2008
Packet Capture for non-Admin Users
Any user on the Fortigate platform used to be able to capture traffic on the ANY interface using
diag sniffer packet any
In FortiOS 3.0 MR6 Fortinet has imposed some restrictions. The admin user can still utilize this syntax. However any non-admin user must now specify an interface to capture traffic on as in the following examples.
diag sniffer packet wan1
diag sniffer packet internal
Trying to capture traffic using the ANY interface results in the following error if you are not the admin user:
diag sniffer packet any
No permission to sniff on interface any
Command fail. Return code -37
diag sniffer packet any
In FortiOS 3.0 MR6 Fortinet has imposed some restrictions. The admin user can still utilize this syntax. However any non-admin user must now specify an interface to capture traffic on as in the following examples.
diag sniffer packet wan1
diag sniffer packet internal
Trying to capture traffic using the ANY interface results in the following error if you are not the admin user:
diag sniffer packet any
No permission to sniff on interface any
Command fail. Return code -37
Subscribe to:
Posts (Atom)