Tag Archives: Fortinet

FortiGate IPv4 vs. IPv6 Performance Speedtests

2016-03-30Bandwidth/Delay, Fortinet, IPv6Bandwidth, FortiGate, Fortinet, Iperf, IPv4, IPv6, Knoppix, ThroughputJohannes Weber

I was interested in the performance of my FortiGate firewall when comparing IPv4 and IPv6 traffic. Therefore I built a small lab consisting a FortiWiFi 90D firewall and two Linux clients running Iperf. I tested the network throughput for both Internet Protocols in both directions within three scenarios: 1) both clients plugged into the same “hardware switch” on the FortiGate, 2) different subnets with an “allow any any” policy without any further security profiles, and finally, 3) activating antivirus, application control, IPS, and SSL inspection.

Continue reading FortiGate IPv4 vs. IPv6 Performance Speedtests →

FortiGate VPN Speedtests

2016-03-15Bandwidth/Delay, Fortinet, IPsec/VPNBandwidth, FortiGate, Fortinet, Iperf, Knoppix, Site-to-Site VPN, ThroughputJohannes Weber

Triggered by a customer who had problems getting enough speed through an IPsec site-to-site VPN tunnel between FortiGate firewalls I decided to test different encryption/hashing algorithms to verify the network throughput. I used two FortiWiFi 90D firewalls that have an official IPsec VPN throughput of 1 Gbps. Using Iperf I measured the transfer rates with no VPN tunnel as well as with different IPsec proposals.

I first ran into really slow performances which were related to the default “Software Switch” on the FortiGate. After deleting this type of logical switch, the VPN throughput was almost as expected.

Continue reading FortiGate VPN Speedtests →

FortiGate HA Cluster

2016-03-03Fortinet, Tutorial/HowtoCluster, FortiGate, Fortinet, HA, High AvailabilityJohannes Weber

This is a step-by-step tutorial for configuring a high availability cluster (active-standby) with two FortiGate firewalls. Since almost all firewall vendors have different principles for their HA cluster, I am also showing a common network scenario for Fortinet.

Continue reading FortiGate HA Cluster →

FortiGate: Software-/ Hardware-/ VLAN-Switch

2016-02-18FortinetFortiGate, Fortinet, Interface, Switch, VLANJohannes Weber

I am still a bit confused about the different switch types a FortiGate firewall is able to handle. While there are a lot of information on the Internet about the “internal-switch-mode” of “switch/interface“, I have not found any good information about the differences between the “Hardware/Software/VLAN” switch types that are configured via the GUI or via the “virtual-switch-vlan enable” CLI command. Though I still don’t know exactly all differences, I am trying to explain some of them here.

Continue reading FortiGate: Software-/ Hardware-/ VLAN-Switch →

Tufin SecureTrack: Adding Devices

2016-01-11Tufin, Tutorial/HowtoCisco ASA, FortiGate, Fortinet, Juniper ScreenOS, Juniper SSG, Palo Alto Networks, SecureTrack, SSH, Syslog, TufinJohannes Weber

Since a few weeks I am using Tufin SecureTrack in my lab. A product which analyzes firewall policies about their usage and their changes by administrators (and much more). Therefore, the first step is to connect the firewalls to SecureTrack in two directions: SSH from SecureTrack to the device to analyze the configuration, as well as Syslog from the device to SecureTrack to real-time monitor the policy usage.

This blog post shows the adding of the following firewalls into Tufin: Cisco ASA, Fortinet FortiGate, Juniper ScreenOS, and Palo Alto PA.

Continue reading Tufin SecureTrack: Adding Devices →

MRTG/Routers2: Template FortiGate

2016-01-08Fortinet, MRTG/Routers2, TemplateFortiGate, Fortinet, MIB, MRTG, Routers2.cgi, SNMP, TemplateJohannes Weber

A few weeks ago I constructed an MRTG/Routers2 template for the Fortinet FortiGate firewalls. I am using it for monitoring the FortiGate from my MRTG/Routers2 server. With the basic MRTG tool “cfgmaker” all graphs for the interfaces are generated automatically. My template is an add-on that appends graphs for CPU, memory, and disk usage, as well as connections and VPN statistics. Furthermore, it implements the ping statistics graph and a “short summary”, which only shows the system relevant graphs.

Continue reading MRTG/Routers2: Template FortiGate →

CLI Commands for Troubleshooting FortiGate Firewalls

2015-12-21Fortinet, MemorandumCheat Sheet, CLI, FortiGate, Fortinet, Quick Reference, SCP, TroubleshootingJohannes Weber

This blog post is a list of common troubleshooting commands I am using on the FortiGate CLI. It is not complete nor very detailled, but provides the basic commands for troubleshooting network related issues that are not resolvable via the GUI. I am not focused on too many memory, process, kernel, etc. details. These must only be used if there are really specific problems. I am more focused on the general troubleshooting stuff. I am using it personally as a cheat sheet / quick reference and will update it from time to time.

Continue reading CLI Commands for Troubleshooting FortiGate Firewalls →

Basic IPv6 Configuration on a FortiGate Firewall

2015-12-16Fortinet, IPv6, Memorandum, TemplateCLI, DHCPv6, DNSSL, FortiGate, Fortinet, IPv6, RDNSS, SLAACJohannes Weber

It’s really great that the FortiGate firewalls have a DHCPv6 server implemented. With this mandatory service, IPv6-only networks can be deployed directly behind a FortiGate because the stateless DHCPv6 server provides the DNS server addresses. (This is unlike Palo Alto or Cisco which have no DHCPv6 server implemented.)

UPDATE: In the meantime Fortinet has implemented the RDNSS and DNSSL options as well. Great. Hence you don’t need DHCPv6 at all anymore to run an IPv6-only network. I updated my listings below as well.

However, the configuration on the FortiGate is really bad because nothing of the IPv6 features can be set via the GUI. (And this is called a Next-Generation Firewall? Not only the features count, but also the usability!) Everything must be done through the CLI which is sometimes hard to remember. Therefore I am publishing this memo of the appropriate CLI configuration commands.

Continue reading Basic IPv6 Configuration on a FortiGate Firewall →

FortiGate 2-Factor Authentication via SMS

2015-12-08Authentication, Fortinet, Password, Tutorial/Howto2-Factor Authentication, FortiGate, Fortinet, SMS, TokenJohannes Weber

Two-factor authentication is quite common these days. That’s good. Many service providers offer a second authentication before entering their systems. Beside hardware tokens or code generator apps, the traditional SMS on a mobile phone can be used for the second factor.

The FortiGate firewalls from Fortinet have the SMS option built-in. No feature license is required for that. Great. The only thing needed is an email-to-SMS provider for sending the text messages. The configuration process on the FortiGate is quite simple, however, both the GUI as well as the CLI are needed for that job. (Oh Fortinet, why aren’t you improving your GUI?)

Here is a step-by-step configuration tutorial for the two-factor authentication via SMS from a FortiGate firewall. My test case was the web-based SSL VPN portal.

Continue reading FortiGate 2-Factor Authentication via SMS →

OSPFv3 for IPv6 Lab: Cisco, Fortinet, Juniper, Palo Alto, Quagga

2015-09-14Cisco Systems, Fortinet, IPv6, Juniper Networks, Palo Alto Networks, Quagga, RoutingCCNP, Cisco ASA, Cisco Router, Dynamic Routing, FortiGate, Fortinet, IPv6, Juniper ScreenOS, Juniper SSG, OSPFv3, Palo Alto Networks, pcap, Quagga, WiresharkJohannes Weber

Similar to my test lab for OSPFv2, I am testing OSPFv3 for IPv6 with the following devices: Cisco ASA, Cisco Router, Fortinet FortiGate, Juniper SSG, Palo Alto, and Quagga Router. I am showing my lab network diagram and the configuration commands/screenshots for all devices. Furthermore, I am listing some basic troubleshooting commands. In the last section, I provide a Tcpdump/Wireshark capture of an initial OSPFv3 run.

I am not going into deep details of OSPFv3 at all. But this lab should give basic hints/examples for configuring OSPFv3 for all of the listed devices.

Continue reading OSPFv3 for IPv6 Lab: Cisco, Fortinet, Juniper, Palo Alto, Quagga →

Policy Routing on a FortiGate Firewall

2015-07-20Fortinet, Routing, Tutorial/HowtoDSL, FortiGate, Fortinet, ISP, NAT, Policy Based Forwarding, Policy Routing, Policy-Based RoutingJohannes Weber

This is a small example on how to configure policy routes (also known as policy-based forwarding or policy-based routing) on a Fortinet firewall, which is really simple at all. Only one single configuration page and you’re done. ;)

Continue reading Policy Routing on a FortiGate Firewall →

IPsec Site-to-Site VPN FortiGate <-> FRITZ!Box

2015-07-17Fortinet, FRITZ!Box, IPsec/VPNDyn DNS, FortiGate, Fortinet, FRITZ!Box, IPsec, Site-to-Site VPNJohannes Weber

Hier kommt ein kurzer Guide wie man ein Site-to-Site VPN zwischen einer FortiGate Firewall und einer AVM FRITZ!Box aufbaut. Anhand von Screenshots zeige ich die Einrichtung der FortiGate, während ich für die FRITZ!Box ein Template der *.cfg Konfigurationsdatei bereitstelle.

Continue reading IPsec Site-to-Site VPN FortiGate < -> FRITZ!Box →

Firewall IPv6 Capabilities: Cisco, Forti, Juniper, Palo

2015-04-21Cisco Systems, Fortinet, IPv6, Juniper Networks, Palo Alto NetworksAdministration, Cisco ASA, DHCPv6, FortiGate, Fortinet, IPv6, Juniper ScreenOS, Juniper SSG, Palo Alto Networks, Policy, Router Advertisement, SLAACJohannes Weber

Since IPv6 gets more and more important, I am using it by default on all my test firewalls, which of course support IPv6. However, when comparing the different functions and administration capabilities, they vary significantly.

Here comes my short evaluation of the IPv6 functions on the following four firewalls: Cisco ASA, Fortinet FortiGate, Juniper SSG, and Palo Alto.

Continue reading Firewall IPv6 Capabilities: Cisco, Forti, Juniper, Palo →

Site-to-Site VPNs with Diffie-Hellman Groups 19 & 20 (Elliptic Curve)

2015-02-13Crypto, Fortinet, IPsec/VPN, Juniper NetworksBits of Security, Brute-Force, Diffie-Hellman, ECC, Elliptic Curve Cryptography, FortiGate, Fortinet, IKE, IPsec, Juniper ScreenOS, Perfect Forward Secrecy, PFS, Site-to-Site VPNJohannes Weber

Similar to my test with Diffie-Hellman group 14 shown here I tested a VPN connection with elliptic curve Diffie-Hellman groups 19 and 20. The considerations why to use these DH groups are listed in the just mentioned post – mainly because of the higher security level they offer. I tested the site-to-site IPsec connections with a Juniper ScreenOS firewall and a Fortinet FortiGate firewall. (Currently, neither Palo Alto Networks nor Cisco ASA support these groups.)

Continue reading Site-to-Site VPNs with Diffie-Hellman Groups 19 & 20 (Elliptic Curve) →

IPsec Site-to-Site VPN FortiGate <-> Cisco ASA

2015-02-05Cisco Systems, Fortinet, IPsec/VPNCisco ASA, FortiGate, Fortinet, IPsec, Site-to-Site VPNJohannes Weber

Following is a step-by-step tutorial for a site-to-site VPN between a Fortinet FortiGate and a Cisco ASA firewall. I am showing the screenshots of the GUIs in order to configure the VPN, as well as some CLI show commands.

Continue reading IPsec Site-to-Site VPN FortiGate < -> Cisco ASA →

Blog Webernetz.net

IT-Security, Networks, IPv6, DNSSEC, NTP, Monitoring, DIY