MIDI-IF for Monotron featured image 604

MIDI-IF for Monotron

Juchu, endlich mal wieder ein Bastelprojekt. Für den Spielzeug-Synthesizer Monotron von Korg gibt es eine kleine Platine namens MIDI-IF, die anstelle des nicht ernsthaft zu spielenden Ribbon-Controller ein MIDI-Keyboard als Eingabequelle verwenden kann. Sprich: Man kann richtige Töne damit spielen, da man die Tasten einer Klaviatur natürlich viel besser bedienen kann als den Ribbon-Controller, bei dem man nur ungefähr die richtige Taste treffen kann. Für knapp 30,- € (inkl. Versand) und ein paar Stunden Löt- und Bastelarbeit kann man loslegen.

Zusätzlich habe ich die Schose in ein Alugehäuse gebaut und mit einer DI-Box versehen. Somit kann es direkt groß losgehen. 😉

Continue reading MIDI-IF for Monotron

Palo Alto disk space 01 error

Palo Alto Software Download Failure

I had an error on my PA-200 with PAN-OS 7.0.5 while trying to download a new firmware version. “Error: There is not enough free disk space to complete the desired operation. […]”. Even the tips to delete older software, dynamic updates, etc., and to use the “set max-num-images count” command did not lead to a successful download.

Finally, the TAC support could solve the problem via root access to the Palo Alto firewall and by manually moving data files…

Continue reading Palo Alto Software Download Failure

Pings featured image

Advanced Ping: httping, dnsping, smtpping

I really love ping! It is easy to use and directly reveals whether the network works or not. Refer to Why Ping is no Security Flaw! (But your Friend) and Advanced Tracerouting. At least outgoing pings (from trust to untrust) should be allowed without any security concerns. However, many companies are denying these ICMP echo-requests from untrust into the DMZ which makes it difficult to test whether all servers are up and running.

I was sitting at the customer’s site replacing the DMZ firewall. Of course I wanted to know (from the outside) whether all servers are connected correctly (NAT) and whether the firewall permits the connections (policy). However, ping was not allowed. Therefore I used several layer 7 ping tools that generate HTTP, DNS, or SMTP sessions (instead of ICMP echo-requests) and revealed whether the services (and not only the servers) were running. Great!

This post shows the installation and usage of httping, dnsping, and smtpping on a Linux machine, in my case a Ubuntu server 14.04.4 LTS, as well as some Wireshark screenshots from captured sessions.

Continue reading Advanced Ping: httping, dnsping, smtpping

IPv6 through IPv4 VPN Tunnel

IPv6 through IPv4 VPN Tunnel with Palo Alto

The most common transition method for IPv6 (that is: how to enable IPv6 on a network that does not have a native IPv6 connection to the Internet) is a “6in4” tunnel. Other tunneling methods such as Teredo or SixXS are found on different literatures as well. However, another method that is not often explained is to tunnel the IPv6 packets through a normal VPN connection. For example, if the main office has a native IPv6 connection to the Internet as well as VPN connections to its remote offices, it is easy to bring IPv6 subnets to these stations. Here comes an example with two Palo Alto firewalls.

Continue reading IPv6 through IPv4 VPN Tunnel with Palo Alto

FortiGate VIP SNAT featured image

FortiGate Virtual IPs without Reference

Migrating from Juniper ScreenOS firewalls to FortiGates, there are some differences to note with static NATs, i.e., Mapped IPs (MIPs) on a Netscreen and Virtual IPs (VIPs) on a FortiGate. While the Juniper MIPs on an interface are always used by the firewall whenever a packet traverses the interface, the virtual IP objects on a FortiGate must be used at least once in the security policy before they are really used by the firewall.

Continue reading FortiGate Virtual IPs without Reference

FortiGate VIP with Interface featured image

FortiGate Virtual IPs with Interface “Any”

On the FortiGate firewall, address objects and virtual IPs (VIPs) can be set up with an interface. For address objects this has no technical relevance – the address objects simply only appear on policies if the appropriate interface is selected. But for virtual IPs, this setting has relevance on how connections are NATed. This can be problematic.

Continue reading FortiGate Virtual IPs with Interface “Any”

Ping-Times-ISP-Routing-Europe featured image

RTTs with different ISPs

Just a short post this time, but an interesting fact concerning different Internet Service Providers (ISPs) and their routing to/from other countries. I have a customer in Germany that has a remote office in France, connected via a site-to-site VPN. Around April last year the french office decided to change the ISP to a cheaper competitor that offers the same speed/bandwidth and therefore has no disadvantages… Well, I disagree.

Continue reading RTTs with different ISPs

FortiGate IPv4-vs-IPv6 featured image

FortiGate IPv4 vs. IPv6 Performance Speedtests

I was interested in the performance of my FortiGate firewall when comparing IPv4 and IPv6 traffic. Therefore I built a small lab consisting a FortiWiFi 90D firewall and two Linux clients running Iperf. I tested the network throughput for both Internet Protocols in both directions within three scenarios: 1) both clients plugged into the same “hardware switch” on the FortiGate, 2) different subnets with an “allow any any” policy without any further security profiles, and finally, 3) activating antivirus, application control, IPS, and SSL inspection.

Continue reading FortiGate IPv4 vs. IPv6 Performance Speedtests

Fritzbox VPN Speedtests featured image

FRITZ!Box VPN Speedtests

Ähnlich zum dem Site-to-Site VPN Throughput Test der FortiGate Firewalls wollte ich mal den FRITZ!Boxen auf den Zahn fühlen und herausfinden, in wie fern sich der VPN-Durchsatz bei den Modellen unterscheidet, bzw. welche Rolle die ausgewählten Verschlüsselungsverfahren spielen. Getestet habe ich eine (etwas ältere) FRITZ!Box 7270v3 mit FRITZ!OS 06.06 sowie eine (neuere, obgleich nicht Topmodell) FRITZ!Box 7430 in Version 06.30. Als VPN-Endpunkt auf der Gegenseite habe ich eine FortiGate Firewall genommen. Getestet wurde das reine Routing/NATting sowie verschiedene Phase 2 Proposals mit dem Netzwerk Tool Iperf.

Continue reading FRITZ!Box VPN Speedtests

FortiGate VPN Speedtests featured image

FortiGate VPN Speedtests

Triggered by a customer who had problems getting enough speed through an IPsec site-to-site VPN tunnel between FortiGate firewalls I decided to test different encryption/hashing algorithms to verify the network throughput. I used two FortiWiFi 90D firewalls that have an official IPsec VPN throughput of 1 Gbps. Using Iperf I measured the transfer rates with no VPN tunnel as well as with different IPsec proposals.

I first ran into really slow performances which were related to the default “Software Switch” on the FortiGate. After deleting this type of logical switch, the VPN throughput was almost as expected.

Continue reading FortiGate VPN Speedtests

Network Transfer featured image

Network Transfer: 1 Big vs. 100 Small Files

A common mistake when analyzing network speed/bandwidth between different applications and servers is to fully rely on the mere size of the files being transferred. In fact, one big file will transfer much faster than thousands of small files that have the same accumulated size. This depends on the overhead of reading/writing these files, building TCP/IP sessions, scanning them for viruses, etc. Furthermore, it is application dependent.

I built a small lab with an FTP server, switch, firewall, and an FTP client in which I played a bit with different file sizes. In this blog post I am showing the measured transfer times and some Wireshark graphs.

Continue reading Network Transfer: 1 Big vs. 100 Small Files