How-to: Inject RADIUS logons to a FortiGate to test RSSO

This post will go through the steps required to send Logon/Logoff RADIUS accounting packets to a FortiGate and a Collector Agent to update it's RSSO table. This can be useful when integrating with third party systems where a script can be used to convert logons from multiple third party systems to a RADIUS logon to the FortiGate/Collector Agent.

How-to: Block Google Translate from translating web pages

While Google Translate is a fantastic education tool it can also be used a proxy to circumnavigate web filtering policies.

I see this happen regularly in schools where web categories such as Pornography are blocked by the FortiGate web filter, but students will use Google Translate to get past this and view inappropriate web pages (albeit in a different language).

This post will go through how you can create a custom application signature to allow Google Translate to be used to translate words, but not used to translate/proxy web pages.

How-to: Configure Static IP Address in TC Linux

1. Create a new file (/opt/eth0.sh) and add the interface IP details below (changing IP, broadcast, and gateway):

#!/bin/sh

ifconfig eth0 10.0.1.219 

netmask 255.255.255.0 

broadcast 10.0.1.255 up

route add default gw 10.0.1.254

2. Make the file executable

sudo chmod +x /opt/eth0.sh

3. Add this line to the end of /opt/bootload.sh

/opt/eth0.sh &

4. Add this line to the end of /opt/.filetool.lst

opt/eth0.sh

5. Save changes to disk

sudo filetool.sh -b

6. Reboot

sudo reboot

How-to: Use the grep command on a FortiGate

Grep is a fast and easy way of filtering lots of information from the console. The FortiGate allows you to pipe grep to many commands including show, get and diagnose.

To use grep you must pipe it with the search value after a command ex: | grep <value>

There are a few options available with grep that can be seen with the -h flag. Below is a show command that's been piped with grep to display all the options available:

gate1 # show | grep -h
Usage: grep [-invfcABC] PATTERN
Options:
        -i      Ignore case distinctions
        -n      Print line number with output lines
        -v      Select non-matching lines
        -f      Print fortinet config context
        -c      Only print count of matching lines
        -A      Print NUM lines of trailing context
        -B      Print NUM lines of leading context
        -C      Print NUM lines of output context

How-to: Configure a FortiAuthenticator to be used for admin RADIUS authentication, Single Sign On and as a Certificate Authority

In the post I'm going to go through the steps on how-to configure a FortiAuthenticator (FAUTH) from scratch so that it can serve as a RADIUS server for admin logins on a FortiGate (FGT), as the Single Sign On (SSO) service for a FortiGate and lastly as a Certificate Authority that will create a cert for a FortiGates admin GUI and to be used in the SSL proxy for deep packet inspection.

It's quite a long one so grab a coffee and get ready!

How-to: Configure a workflow in FortiManager to enforce change management policies

The FortiManager allows you to enforce change management policies so that while junior members are able to make configuration changes, they will not be applied until management approves them.

This blog will go through the steps on how-to set this up.

How-to: Configure a pre-login warning message on a FortiGate

By default when you login to a FortiGate there is no warning message. This blog will go through howto enable the banner and edit the default message to help scare away those baddies.

How-to: Automate user browsing from a text file containing URLs

In this blog I'll go through how I configure my lab environment so that computer/users will automatically connect to web servers via a text document on a schedule. The reason I set this up is to simulate constant 'real world' browsing from computers in the lab so that my web filtering reports are filled up when it comes time to demo to customers!

How-to: Create a YouTube report for the FortiAnalyzer

One of the new features of FortiOS 5.2 was the introduction of Cloud Application logging which allows you to track web application traffic like Youtube videos, email address logins and files uploaded/downloaded via Dropbox.

This quick how-to guide goes through creating a small chart that will only show us the YouTube videos that have been watched and the users that watched them.

This config is done a FortiAnalyzer running 5.2.2.

How-to: Configure DLP fingerprinting on a FortiGate

The following how-to guide will take you through the steps to configure DLP fingerprinting on the FortiGates.

Before we begin we need to confirm two things.

Firstly, the FortiGate model you are configuring has a storage drive. Models like the FG80C have no storage so DLP fingerprinting won't work.

Secondly DLP has been enabled in the web-gui. If it's not you can enable it via the CLI with the following commands:

config system global
set gui-dlp enable
end

For FortiGates running 5.2 you'll need to goto Security Profiles > Advanced > DLP Fingerprinting. If you're running 5.0 it will be found under Security Profiles > DLP > DLP Fingerprinting.

How-to: Change WebGUI HTTPS certificate on Fortinet devices

Below is a list of commands required to change the default HTTPS certificate that gets presented on the admin WebGUI.

For each of these examples I've already loaded a certificate called 'webgui-cert'. Change this value to match the certificate you import.

How-to: Disable SSLv3 on Fortinet devices

With the release of the POODLE vulnerability, Fortinet have released a great article on howto disable SSLv3 on all the Fortinet devices that are affected.

The list goes on to include:

• FortiGate
• FortiMail
• FortiAnalyzer
• FortiManager
• FortiAuthenticator
• FortiCache
• FortiWeb
• FortiDDOS
• FortiADC-D
• FortiClient
• FortiVoice-Enterprise
• FortiRecorder
• FortiDB
• FortiSwitchOS
• FortiSwitch ATCA

Fortunately disabling SSLv3 is very simple on all devices, with some just requiring an upgrade.

I won't go into detail on howto disable SSLv3 on every box as it's covered in the article linked above. I just wanted to go through on how you can test to ensure that SSLv3 has been disabled once you've made the configuration change.

How-to: Configure Quotas by Data Usage on a FortiGate

Long ago, you had two options when it came to usage quotas on the FortiGate; it was either based on data usage, or time usage. Fortinet then decided to remove the data usage quota and only have time based ones available. Recently Fortinet have decided to reintroduce the data based quotas (albeit it can only be configured via the CLI).

We'll go through creating a data usage quota on a web filtering profile, and some things you should know.

How-to: Change default policy columns on a FortiGate

When you log into a FortiGate and browse to the policies section you will see the pre-defined default policy columns which include seq#, source, destination, schedule, service, action, nat, av etc..

I normally go through and change the columns so that they are more compact. Generally this includes adding the 'policy ID' column, removing the schedules, replacing all the UTM columns with the 'security profiles' column and moving a few others around as per below:

Now this is all well and good, except for the fact that it will only save these columns for the computer and browser that I'm using. If I connect via another browser or from another device then the default columns will show up again.

Good news is that the default columns can all be changed with a setting to ensure that the columns you want to show up by default will, no matter which browser or computer you connect from.

How-to: Configure User Alias Options on a FortiMail

If your organisation is using aliases, it's generally a good idea to configure the 'User Alias Options' within the LDAP settings to ensure users only get one quarantine email for all their addresses, instead of one for each alias address.

To configure this, first edit the LDAP profile you've configured for your domain (found under Profile > LDAP) and expand the 'User Alias Options' section.

Ensure the tickbox has been enabled next-to 'User Alias Options', then configure your base DN, Bind DN and Bind password as normal. For the 'Alias member query' option use proxyAddresses=smtp:$m. Lastly untick the 'User group expansion in advance' box.

Your final configuration should look something like this:

To test this out click on the 'Test LDAP Query...' link near the top of the LDAP profile page. From here choose 'Alias' from the dropdown menu and type in your email address at the bottom. For the below example my normal email address is amouawad@wglab.com.au and my alias is allan@wglab.com.au.

Click on 'Test' and you should see the alias match!

How-to: Configure a User Group using LDAP filters on a FortiAuthenticator

Recently I've been playing around with a FortiAuthenticator which turns out to have some very cool features. One thing I noticed while configuring my user groups, is that it relies on 'LDAP filters' to define your groups. What I couldn't find was an explanation regarding the format on which to configure these groups.

The administration guide has no information except that you need to use an 'LDAP filter' here... being an LDAP noob I tried to put the CN of my group as per below, but it didn't like it...

CN=fulladmin,OU=Groups,OU=Lab,DC=wglab,DC=com,DC=au

After searching for a while I've found some on-line articles on LDAP search queries and have found the below query to work. This will match all users in the 'Fulladmin' group.

(&(objectCategory=user)(memberOf=CN=fulladmin,OU=Groups,OU=lab,DC=wglab,DC=com,DC=au))

How-to: Factory reset a FortiGate config but preserve the interface IP address

Not many people realise the FortiGates allow to you factory reset the device while maintaining the interface IP and static route settings. It's useful when you want to wipe away the entire config but still have management access to the device when it reboots.

This is done via the CLI using the follow command: execute factoryreset2.

I've included a screenshot of the command and confirmation prompt below.

How-to: Seperate UTM security logs from traffic logs

With FortiOS 5.0 Fortinet had decided to consolidate all logs into the traffic log. This improves performance, and allows you to search for all logs (traffic and security) in the one screen.

While I can see the benefit and reasoning behind this, I prefer to have my security logs separated from my traffic ones since they are generally the kind that I would look through.

Thankfully Fortinet haven't disabled this feature and still allow you to configure the device to separate the security and traffic logs. We'll go through the steps required to enable this for each of the security profiles.

How-to: Create a SSL VPN login report on a FortiAnalyzer

This quick how-to guide will go through creating a chart/report on a FortiAnalyzer to show successful SSL VPN logins, displaying the date/time, user, mode (tunnel or web) and the remote IP address the VPN was established from.

This config is done on a FortiAnalyzer running 5.0.6.

How-to: Upgrade a FortiGate HA Cluster

I often get asked how well the FortiGates handle firmware upgrades when they're in a high availability cluster. Clients want to know how the upgrade is handled and if there's any 'gotchas' they should be aware of.

Great news is that for the last few years the HA firmware upgrades are very simple and automated. No more manually breaking, upgrading then rejoining the clustered units each time a firmware upgrade is required.