Yuri Slobodyanyuk's blog on IT Security and Networking sharing experience and expertise

Category: Firewall (page 1 of 4)

Limit maximum size of scanned files in Fortigate firmware 4

New operating systems are supposed to better user experience .. I thought. Well, so I thought, until today, when I had a need to lower the maximum size of files to be scanned by Fortigate 80C . It was a matter of few clicks in the good old version 3 via management GUI but in version 4 I spent some 20 minutes digging its GUI high and low and then finally opened Command Reference and found how to do it the CLI way.
Here is the solution :

FTG80C# config antivirus service http
FTG80C(http)# sho

config antivirus service “http”
set scan-bzip2 disable
set uncompnestlimit 12
set uncompsizelimit 10

FTG80C(http) # set uncompsizelimit 2
FTG80C(http) # end

FTG80C# config antivirus service ftp
FTG80C(ftp) # set

scan-bzip2 enable scanning of bzip2 compressed files
uncompnestlimit uncompnestlimit
uncompsizelimit uncompsizelimit

FTG80C(ftp) # set uncompsizelimit

max uncompressed size to scan (1-50MB or use 0 for unlimited)

FTG80C(ftp) # set uncompsizelimit 2
FTG80C(ftp) # end

Best open source Netflow/sFlow analyzing software

People ask me frequently what software I would   recommend   for Netflow analysis , especially with security implementations in mind.  I made my choice a long ago and haven’t been complaining so far – Nfsen graphical frontend that has Nfdump as its data processing backend . It provides most flexibility, configurability; its filter syntax is very tcpdump-like; graphic front provides just enough of interactivity; the alerts system is just amazing.Moreover it supports not only Netflow but sFlow as well,so all Fortigate appliances with the last OS can be monitored this way.

fw ctl or checkpoint tables by any other name

Holidays are over, Checkpoint failures are back, so business as usual. Today I want to draw your attention to often overlooked information source – Checkpoint state tables. While running, the firewall creates, keeps and updates various tables it needs for correct functioning. These tables contain parameters that are mostly of use for firewall itself, but you can query them on the cli, sometimes even flush them as well.
To see all tables with its contents you type –
[Expert@Hollywood]# fw tab
To see only table names –
[Expert@Hollywood]# fw tab | grep "\-\-\-\-\-\-\-"

——– vsx_firewalled ——–
——– firewalled_list ——–
——– external_firewalled_list ——–
——– management_list ——–
——– external_management_list ——–
——– log_server_list ——–
——– tcp_services ——–
——– udp_services ——–
——– internal_interface_list ——–
——– topology_range_list ——–
——– gui_clients_list ——–
——– cp_NG_products_list ——–
——– smtp_av_user_config_match_tab ——–
——– smtp_av_scan_exclusion ——–
——– http_av_user_config_match_tab ——–
——– http_av_scan_exclusion ——–
——– pop3_av_user_config_match_tab ——–
——– pop3_av_scan_exclusion ——– Continue reading

Fortigate BGP – configure and debug

Everyone today speaks BGP: Cisco routers, Juniper routers and ScreenOS firewalls, Fortigate does it,even SonicWall have it as planned feature So question is not whether but how. The opportunity to see how it works on Fortigate recently presented itself and here is the sum up of how I configured and debugged Fortigate BGP set up.
Task at hand: configure BGP peering with Bogon Route project by Team Cymru www.team-cymru.org/Services/Bogons/routeserver.html . More information about the Bogon Routes can be found at the source – www.team-cymru.org/Services/Bogons . But in few words they advertise to you routes that are never to be seen in your network for legitimate reasons. Those are networks not only from RFC 1918 but those reserved by RIPE for special purposes, and those unallocated to anyone as of now.
What we need to know for this set up is this:

  • They advertise all the networks with no-export community
  • also they attach 65333:888 community (as per their site)
  • they use md5 password authentication
  • they don’t expect you to advertise to them anything
  • in advertised networks next hop is their advertising router
  • their AS number is 65333

Based on all the above my Fortigate BGP peer had to :

  • enable multihop peering
  • use MD5 password authentication
  • have route-map to attach no-export community so that we don’t inadvertently advertise learned routes to other peers ( just safety net , in case BGP peer stops attaching no-export community to their routes)
  • set next hop for the learned routes to Null 0 interface.

Let’s start configuring something. Important surprise here – in Fortigate GUI you can only set 3 parameters:
As number , Peer Ip and networks to be advertised, the rest is to be done on the command line . So here it goes
1) Configuring route-map to set no-export community on learned networks and force next hop to be some reserved Ip ( ) that in turn is statically routed to Null interface ,

config router route-map
edit “NO-EXPORT”
config rule
edit 3
set set-community “no-advertise”
set set-ip-nexthop

2) Configure BGP peer

(root) # show router bgp
config router bgp
set as 65002
config neighbor
set ebgp-enforce-multihop enable
set remote-as 65333
set route-map-in “NO-EXPORT”
set password “yuiyui”
config redistribute “connected”
set status enable

3) Configure static blackhole route for the reserved IP used as the next hop for this.

(root) # sh router static
config router static
edit 3
set blackhole enable
set dst

Validation phase.
All configs are as good as the prove that it works.

List shortly all the peers

(root) # get router info bgp summary
BGP router identifier, local AS number 65002
BGP table version is 159
2 BGP AS-PATH entries
0 BGP community entries
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd   4  65333       4       6      159    0    0 00:00:48        0
Total number of neighbors 1 

List all BGP neighbors and their peering state

My-FG (root) # get router info bgp neighbors
BGP neighbor is, remote AS 65333, local AS 65002, external link
  BGP version 4, remote router ID
  BGP state = Established, up for 00:00:58
  Last read 00:00:58, hold time is 180, keepalive interval is 60 seconds
  Configured hold time is 180, keepalive interval is 60 seconds
  Neighbor capabilities:
    Route refresh: advertised and received (old and new)
    Address family IPv4 Unicast: advertised and received
  Received 4 messages, 0 notifications, 0 in queue
  Sent 6 messages, 0 notifications, 0 in queue
  Route refresh request: received 0, sent 0
  Minimum time between advertisement runs is 30 seconds
 For address family: IPv4 Unicast
  BGP table version 160, neighbor version 159
  Index 3, Offset 0, Mask 0x8
  Community attribute sent to this neighbor (both)
  Inbound path policy configured
  Route map for incoming advertisements is *NO-EXPORT
  0 accepted prefixes
  19 announced prefixes
  Connections established 1; dropped 0
  External BGP neighbor may be up to 255 hops away.
Local host:, Local port: 9188
Foreign host:, Foreign port: 179

See the routes learned through the BGP protocol

(root) # get router info bgp network
BGP table version is 161, local router ID is
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i
*>                0             0 65333 65333 i

List routes that are currently installed in the routing table that were learned by BGP .

(root) # get router info routing-table bgp
B [20/0] via (recursive is directly connected, unknown), 00:00:19
B [20/0] via (recursive is directly connected, unknown), 00:00:19
B [20/0] via (recursive is directly connected, unknown), 00:00:19
B [20/0] via (recursive is directly connected, unknown), 00:00:19
B [20/0] via (recursive is directly connected, unknown), 00:00:19
B [20/0] via (recursive is directly connected, unknown), 00:00:19
B [20/0] via (recursive is directly connected, unknown), 00:00:19
B [20/0] via (recursive is directly connected, unknown), 00:00:19

After all is configured and saved (and probably doesn’t work) comes the bgp debug round.
Enable bgp debug on the appliance

#diag ip router bgp all enable

Enable debug output to console

diag debug enable

To stop this output

diagnose debug disable

To verify that debug is on

# diag ip router bgp show
BGP debugging status:
  BGP events debugging is on
  BGP debug level: INFO 

If nothing after that happens try clearing all BGP sessions

#exec router clear bgp all

The good way to judge something new is to compare it with something you already know. To continue
With that logic I cross-reference debug output seen on Fortigate with the one seen on the Cisco BGP peer. That
way you can decide what is more informative and who wins the race (Cisco of course, what you thought?).

Case 1
One of the peers is configured with wrong AS number.
In Fortigate you see this:

BGP: [FSM] State: Idle Event: 3
BGP: [NETWORK] FD=15, Sock Status: 0-Success
BGP: [FSM] State: Connect Event: 17
BGP: [ENCODE] Msg-Hdr: Type 1
BGP: [ENCODE] Open: Ver 4 MyAS 65002 Holdtime 180
BGP: [ENCODE] Open: Msg-Size 45
BGP: [DECODE] Msg-Hdr: type 3, length 23
BGP: %BGP-3-NOTIFICATION: received from 2/2 (OPEN Message Error/Bad Peer AS.) 2 data-bytes

Now let’s compare to the debug from Cisco

#debug ip bgp events
Mar 24 13:14:55.572: %BGP-3-NOTIFICATION: sent to neighbor 2/2 (peer in wrong AS) 2 bytes FDEA FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 002D 0104 FAEA 01B4 0AFA EA02 1302 0201 1400 0100 0132 0222 0012 0222 00

Case 2
MD5 authentication is set on Cisco but not on the Fortigate. Again for comparison
debug from Fortigate and debug from Cisco

Jan  5 10:42:14.299: %TCP-6-BADAUTH: No MD5 digest from (1037) to

Fortigate: [FSM] State: Connect Event: 9
BGP: [RIB] Scanning BGP Network Routes... [FSM] State: Connect Event: 9
BGP: [RIB] Scanning BGP Network Routes...

Case 3 (that actually happened when I configured this Fortigate) is mismatched MD5 password on either side

Doing summary listing showed peering as down :   4  65333     934    1036        0    0    0    never Connect 


*Mar 24 13:40:28.800: BGP: Regular scanner event timer
*Mar 24 13:40:28.800: BGP: Import timer expired. Walking from 1 to 1
*Mar 24 13:40:42.764: %TCP-6-BADAUTH: Invalid MD5 digest from to

Case 4 On Cisco ttl-security is enabled while on Forigate ebgp multi-hop is not .
There is no such thing as TTL security on the Fortigate by the way, all you can do to handle this state is enable ebgp-multihop and them it starts sending BGP packets with ttl = 255 .


Jan  7 13:01:36.992: %BGP-4-INCORRECT_TTL: Discarded message with TTL 2 from


BGP: [FSM] State: OpenConfirm Event: 11
BGP: [ENCODE] Msg-Hdr: Type 4
BGP: [ENCODE] Keepalive: 13548 KAlive msg(s) sent [FSM] State: OpenConfirm Event: 10
BGP: [ENCODE] Msg-Hdr: Type 3
BGP: %BGP-3-NOTIFICATION: sending to 4/0 (Hold Timer Expired/Unspecified Error Subcode) 0 data-bytes
BGP: [FSM] State: Idle Event: 3
BGP: [NETWORK] FD=14, Sock Status: 111-Connection refused
BGP: [FSM] State: Connect Event: 18

Bonus Case Bug-not-a-feature thing on the Fortigate – when configuring MD5 password for BGP authentication you get Cross-Site vulnerability protection for free 🙂 Don’t ask me how XSS is connected to cli configuration of BGP …

set password <2AEARep>

The string contains XSS vulnerability characters
value parse error before ”
Command fail. Return code -173

VPN client stops working in visitor mode after major update

Yesterday I got asked to check the Checkpoint VPN Secure Client issue . After upgrade from NGX R65 to R70 VPN client doesn’t connect when Visitor mode is enabled . The moment you disable Visitor mode the same client to the same firewall works just fine. This happens
often so I bring it here . Actually I see it as the “it is a feature not a bug” case –
after major upgrades to the firewall, the Management WebGUI (the one you use after fresh install to run the wizard) listening port will be reset to its default value of 443. This in turn prevents any other daemon/service listening on this port , so Visitor mode (I guess also SSL Extender) will not work.
To fix it you just change listening port for WebGUI. Now lets get to SSH:
To see the problem:

#lsof -i -n | grep https

cp_http_s 1864 nobody 11u IPv4 14977 TCP *:https (LISTEN)

To fix the problem:

#[Expert@fw]# webui disable

Shutting down cp_http_server_wd: [ OK ]

[Expert@fw]# webui enable 4445

Running cp_http_server_wd: [ OK ]

Now WebGUI wil be listening on port 4445 , and vpnd as should will be listening on 443:

[Expert@fw]# lsof -i -n | awk ‘/https/ || /4445/’

vpnd 3564 root 26u IPv4 29060053 TCP *:https (LISTEN)
cp_http_s 10300 nobody 5u IPv4 29100889 TCP *:4445 (LISTEN)

fw monitor add-on

There is something I didn’t include in the previous post fw monitor command reference about fw monitor as I think it is rather optional and you can do well without it . I talk about tables in defining filter expressions. INSPECT – proprietary scripting language by the Checkpoint on which filtering expressions are based allows creating tables.
I won’t delve into INSPECT syntax (for today) but will list the following examples you can easily modify to suit your needs.

{} – delimit the table
<,> – specify range of values inside (e.g. <22,25> means from 22 up to 25 inclusive)
ifid – interface identifier

#fw monitor -e "bad_ports = static {22,25,443}; accept dport in bad_ports;”   packets with destination port bein" equal to 22,25 or 443
#fw monitor -e " bad_ports = static {<22,25>} ; accept dport in bad_ports;"  packets with destination ports being equal to 22,23,24 or 25
# fw monitor -e " bad_ports = static {<22,25>,<80,443>} ; accept dport in bad_ports;"  packets with destination ports being in ranges 22-25 or 80-443
#fw monitor -e "bad_nets = static {<,>} ;accept src in bad_nets;"  packets originated in range of networks –
#fw ctl iflist   Here I see what are the index values of each interface card
0 : Internal
1 : External
#fw monitor -e "bad_nets = static {<,>} ;accept src in bad_nets and ifid=0;"  packets originated in range of networks – and captured on interface eth3 only

Fortigate firewall demo free access. Also FortiManager and FortiAnalyzer

As someone said best things in life are free.
Here are links to the demo Forigate firewall, ForiAnalyzer and FortiManager open to access from anywhere . So that you can
familiarize yourself with the Management GUI look and feel.
NOTE: Access is read-only.
NOTE 2: No , it is not me being so generous, it’s Fortinet caring for us.
Fortigate 300 :
password: fortigate
ForiAnalyzer 800:
password: fortianalyzer
FortiManager 400:
password: fortimanager

Older posts

© 2016 yurisk.info

Theme by Anders NorenUp ↑