The new series Sangfor firewall - Sangfor Network Secure

The new series Sangfor firewall - Sangfor Network Secure. (NSF-1050A-I, NSF-1100A-I, NSF-3100A-I and NSF-7100A-I). This new series are running on OS - Network Secure Platform (Network Secure 8.0.85 - the first release)

One of the new feature - "SOC Lite" which is good for security administrators.

It is also able to intergrate with Sangfor Security Cloud and Sangfor Endpoint Security

Reference:

https://www.sangfor.com/cybersecurity/products/network-secure-next-generation-firewall

The new series Sangfor firewall - Sangfor Network Secure

H3C firewall SSL weak cipher

Nessus vulnerability scan report about H3C firewall SSL weak cipher 

Go to "Objects" -> "SSL" -> "SSL Server Policies"

You will found that even you select "TLS 1.2" and Cipher suites "High level":

SSL_RSA_with_AES_128_CBC_SHA

SSL_RSA_with_AES_256_CBC_SHA

You still false in the security scanning report and it will show weak cipher.

Solution:

Use the following 4 Cipher:

 

https://www.tenable.com/plugins/nessus/156899 

After change the cipher under firewall GUI, then SSH to the firewall

 

> system-view

 

] undo ip https enable

 

] ip https enable

 

] save force

 

] exit

 

>

 

H3C firewall SSL weak cipher

H3C Firewall Change admin portal certificate

1. Go to H3C Firewall -> SSL -> SSL Server Policies to create a new Policy e.g. "abc_2024-2026"

2. Create a PKI Domain for new cert installation

3. Go to PKI -> Certificate -> Import 2 CA cert and 1 local cert

CA to provide TWO CA cert (.cer) (When install second CA, just ignore the cert will be replace warning) and One local cert (.pfx) (RSA 2048) (This local cert need to includ private key and also ignore the cert will be replace warning)

4. SSH to the firewall 

 > show current-configuration (Enable logging on putty before run this command) 

 > system-view ] undo ip https enable 

 ] ip https ssl-server-policy <New Policy Name which is you create at step1> 

 ] ip https enable 

 ] save force 

 ] exit 

 >

H3C Firewall Change admin portal certificate

H3C Security Management Platform - Firewall Management like Fortimanager

The H3C Security Management Platform running on H3Linux―H3C proprietary Linux operating system

H3Linux是基于CentOS进行封装的，所以安装过程和CentOS基本一致（CentOS操作系统最小化安装部署）

H3C Security Management Platform - Firewall Management like Fortimanager

OpenGFW is a flexible, easy-to-use, open source implementation of GFW on Linux - Github

The solution installation manual:

https://github.com/apernet/OpenGFW

The Openwrt routers:

https://openwrt.org/toh/recommended_routers

https://openwrt.org/docs/guide-user/network/openwrt_as_routerdevice

You can find a router which is support Openwrt, then install OpenGFW on it. Since the OpenGFW is early development stage, use it carefully.

Reference:

https://gitee.com/opengfw

https://unwire.hk/2024/02/13/opengfw/tech-secure/

https://www.hkepc.com/22137/GitHub_%E5%87%BA%E7%8F%BE_OpenGFW_%E9%96%8B%E6%BA%90%E7%B3%BB%E7%B5%B1_%E6%A8%A1%E6%93%AC%E4%B8%AD%E5%9C%8B%E9%95%B7%E5%9F%8E%E9%98%B2%E7%81%AB%E7%89%86_%E8%AE%93%E6%B5%B7%E5%A4%96%E4%B8%AD%E5%9C%8B%E4%BA%BA%E6%9C%89%E5%9B%9E%E5%AE%B6%E7%9A%84%E6%84%9F%E8%A6%BA

https://www.routerfreak.com/best-openwrt-router/

OpenGFW is a flexible, easy-to-use, open source implementation of GFW on Linux - Github

H3C firewall considersation

1. Copy firewall rule will go to the last firewall rule (the button of the rule set), when you have few hundred firewall rule, administration will be painful.
2. Traffic log need local harddisk of the firewall, syslog cannot cover. Need to aware to buy firewall with local harddisk.

H3C firewall considersation

Sophos Firewall failed to access web admin console after upgrade from SFOS 19.0.3 MR-3-Build517 to SFOS 19.5.3 MR-3-Build652

After the upgrade, you still able to see the login page:

And also, you able to access Internet via the firewall:

But you failed to login the firewall web console: (Return a blank page)

You able to access firewall via SSH:

Solution:

Use SSH to login, then select "7" , then "R" to reboot the firewall.

Reference:

https://community.sophos.com/sophos-xg-firewall/f/discussions/142061/help-firewall-is-reachable-from-internet-but-not-able-to-connect-to-vpn-or-internal-servers

https://support.sophos.com/support/s/article/KB-000038694?language=en_US#:~:text=Check%20the%20connectivity%20to%20Sophos%20Firewall&text=Otherwise%2C%20try%20to%20access%20the,WAN%20IP%20of%20Sophos%20Firewall.&text=Try%20to%20use%20another%20browser,on%20port%2022%20via%20putty.

Sophos Firewall failed to access web admin console after upgrade from SFOS 19.0.3 MR-3-Build517 to SFOS 19.5.3 MR-3-Build652

How to resolve the Hillstone firewall failed to update the Signature Database from Internet?

 

Problem: Upgrade failed: Download signature failed; please confirm the servers are reachable

 

 

 

Reason:

 

The firewall DNS did not setup

 

 

Solution: Add DNS Server on trust-vr

 

 

 

How to resolve the Hillstone firewall failed to update the Signature Database from Internet?

Setup the Hillstone Firewall to connect to Internet

1. Create Zone on the WAN interface (E0/1)

2. Binding Interface E0/1

3. Set the static IP (WAN IP) – You telco assign to you.

4. New DHCP Server:

 

 

5. Select your LAN Interface E0/0

6. New SNAT

 

7. New Security Policy

8. New routing

Setup the Hillstone Firewall to connect to Internet

How to reboot Hillstone Firewall on GUI

Go to System > Device Management > Options > System Option, click Reboot.

Reference:

 

https://kb.hillstonenet.com/en/wp-content/uploads/2015/06/StoneOS_5.5R1_Getting_Started_Guide.pdf

 

How to reboot Hillstone Firewall on GUI

Sophos firewall model compare with Hillstone/H3C/Huawei/Sangfor

 

 

Brand	Model	Hillstone (E series)	Hillstone(A series)	H3C	Huawei	Sangfor
Sophos	XGS 3100	E5568	SG-6000-A3700	H3C SecPath F5030	USG6620E	NGAF M5800
Sophos	XGS 3100	E3965	SG-6000-A2800	H3C SecPath F1070	USG6610E	NGAF M5600
Sophos	XGS 2100	E3965	SG-6000-A2700	H3C SecPath F1070	USG6575E	NGAF M5400
Sophos	XGS 5500	E5960	SG-6000-A5200	H3C SecPath F5060	USG6610E	NGAF M6000
Sophos	XGS 136	E3662	SG-6000-A2000	H3C SecPath F1070	USG6585E	NGAF M5300

Sophos firewall model compare with Hillstone/H3C/Huawei/Sangfor

Hillstone firewall

Hillstone firewall admin login page:

 The Dashboard:

The Hot Threat Intelligence did not need additional license, it is provide TI for IPS to block the attacks which is exploit those hot vulnerability

 

 

 

 

 

 

 

 

 

Hillstone firewall

How to enable IPv6 native mode on Sophos SG UTM

 

1. Enable IPv6

 

2. Enter IPv6 fixed IP address , Netmask and Default GW address on WAN Interface

 

3. Add IPv6 address to Internal

 

 

 

4. Add Prefix Advsetis….. to intermal

You should able to see the WAN IP of IPv6

 

 

Test:

Go to "Support" -> "Tools"

 

 

Internal IPv6 address: fda8:06c3:ce53:a890:0000:0000:0000:0004 (Unique Local )

 

1. enable IPv6
2. force the UTM to request a prefix (not sure why I needed to do it)
3. add <prefix>00::1 as the IP address on the LAN interface (64-bit mask)
4. advertise the prefix on the LAN interface using stateless integrated server
5. enable automatic renumbering

 

 

Reference:

 

https://www.sysorchestra.com/configuring-ipv6-with-sophos-utm-9-and-kabeldeutschland/

https://simpledns.plus/private-ipv6

http://www.steves-internet-guide.com/ipv6-guide/

https://community.sophos.com/utm-firewall/f/management-networking-logging-and-reporting/116941/utm-vs-ipv6

https://www.jannet.hk/zh-Hant/post/IP-Address-Version-6-IPv6/

 

How to enable IPv6 native mode on Sophos SG UTM

Juniper and Cisco Firewall Product line and OS change

Juniper Firewall

From Netscreen to SSG to SRX and the OS also from ScreenOS to JUNOS

 

Product series	Netscreen and SSG	SRX
OS	ScreenOS	JUNOS

 

 

Cisco Firewall

From PIX to ASA to Firepower

 

Product series	PIX	ASA	Firepower
OS	PIX OS (Finesse)	ASA OS (Linux)	FXOS

Juniper and Cisco Firewall Product line and OS change

Firewall selection consideration

Product
Company
Certifications	NSS Labs Security Effectiveness for NGFW - ?% Effectiveness for BDS - ?% Effectiveness for IPS -?% ICSA (Firewall, IPSec, SSL, Antivirus, NIPS, Antispam) IPv6 VB 100 - ?% AV Comparative - ?% Cyber Threat Alliance
# interfaces	GE RJ45 GE SFP 10GE SFP+ Modules Slot
Throughput and Performance
Firewall Throughput	This is raw throughput, the measurement of traffic flowing through the firewall without necessarily being subjected to antivirus scans, content filtering, intrusion prevention, data loss checks and similar steps. The figure can also vary by protocol and packet size. Some vendors may cite 1500 Byte TCP whilst others 64 Byte UDP 1518/512/64 byte UDP
IPS Throughput	Gbps(Optimal traffic),  Gbps(Enterprise Mix)
NGFW/UTM Throughput	Gbps(Enterprise Traffic Mix)
SSL Inspection Throughput
AV Proxy Throughput
Sessions
New Sessions per second
IPSec VPN	Gbps
Tunnels	No. of Tunnels (e.g. 10000)
SSL VPN	Gbps
Firewall Policies
Latency	Microsecond
Remark	When compare between different vendor on performance, it need to confirm they are using the same assumption to provide the figure (e.g. Vendor A will enable all features when testing throughput but Vendor B will disable all features)
Features
SD-WAN
DNS Filter
Web Filter
IPS	(No. of signatures)
Anti-Spam
Antivirus Gateway
Sandbox Integration	Cloud and/or On-perm
Application Control
SSL Inspection	443 Port only or ALL ports?
Data Leak Prevention (DLP)
Content Filtering
Web Application Firewall (WAF)
Reverse Proxy
Forward Proxy
Virtual Domain
High Availability
3rd Parties Security Solution Integration
Power Supply	Single or Dual PSU
Operation
Administration Effort	High/Low
Management	Console/Web
Reporting
Automation
Vendor Support
Cost
Licensing/Subscription
On-going cost /Maintenance cost

 

Reference:

https://www.manxtechgroup.com/small-business-firewall-guide/

Firewall selection consideration