Fortinet Fortigate Firewall - SSL Inspection - Certificate Inspection and Deep (Full) Inspection

 

Fortinet Fortigate Firewall - SSL Inspection - Certificate Inspection and Deep (Full) Inspection

Install Fortinet Forticlient VPN on Deepin 23.1 (For SSL cert is self-signed cert)

1. echo -n | openssl s_client -showcerts -connect registry.example.com:port 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > xxca.crt

Replace the "registry.example.com:port"  to your SSL VPN gateway URL and port.

2. Go to the file "xxca.crt", use a editor like "notepadqq" to open the file

3. Copy all the text in the xxca.crt

4. sudo vi /usr/local/share/ca-certificates/xxca.crt

5. Paste all text into this file and :wq (To save those text)

6. sudo update-ca-certificates

7. Reboot your machine

8. Then you can use the Forticlient to connect your VPN gateway. 

Reference:

https://blog.keepchen.com/a/configure-forticlient-vpn-on-deepin-25.html

Install Fortinet Forticlient VPN on Deepin 23.1 (For SSL cert is self-signed cert)

Receive OpenSSL error from one IP and another one IP is normal

SSL_ERROR_SYSCALL

One destination IP address able to connect another cannot. 

Solution: Add the URL to URL whitelist on Cloud Fortinet Fortigate Firewall

Receive OpenSSL error from one IP and another one IP is normal

Identifying and preventing unwanted DNS queries from FortiGate's FQDN Address ObjectYES

FQDN on firewall rule to AWS service, sometime need to fine tune the DNS TTL

Reference:

Identifying and preventing unwanted DNS q... - Fortinet Community

Explanation of the FQDN default cache-ttl... - Fortinet Community

How to deal with FQDN with short DNS TTL - Fortinet Community

How To Change Session TTL For A Firewall Policy In FortiGate (hex64.net)

Identifying and preventing unwanted DNS queries from FortiGate's FQDN Address ObjectYES

Fortigate DNS and Server DNS different case connection rejected on firewall

When the destination URL on CDN e.g. AWS. 

If your Fortigate DNS and Server DNS different case connection denied on firewall

Solution:

To align with those device DNS is same.

Fortigate DNS and Server DNS different case connection rejected on firewall

Fortinet SSL VPN - SSL Certificate expired and you need to bypass tempoarilty

Configure SSL VPN to Not Require Certificates

Go to VPN > SSL > Settings > and un-check Require Client Certificate.

Fortinet SSL VPN - SSL Certificate expired and you need to bypass tempoarilty

Tencent Cloud using 3rd parties firewall for Internet edge firewall solution - Fortinet

Instead of using Tencent Cloud Firewall Service - Internet Edge Firewall, Fortinet Firewall can use for Internet edge firewall solution.

Reference:

FortiGate基于腾讯云平台部署文档

https://market-10039692.file.myqcloud.com/document/9/fb498bad684d923955af09d4a5eb067c.pdf

https://www.fortinet.com/products/private-cloud-security/fortigate-virtual-appliances

Tencent Cloud using 3rd parties firewall for Internet edge firewall solution - Fortinet

FG-IR-24-029 (Affected version: 7.x) (CVE-2024-23113) - (CVSS 9.8) - Fortinet Fortigate

FG-IR-24-029: FortiOS - Format String Bug in fgfmdA use of externally-controlled format string vulnerability [CWE-134] in FortiOS fgfmd daemon may allow a remote unauthentified attacker to execute arbitrary code or commands via specially crafted requests.


Solution reference Link: https://www.fortiguard.com/psirt/FG-IR-24-029  

Follow the recommended upgrade path using our tool at: https://docs.fortinet.com/upgrade-tool 

This one need to patch ASAP if your firewall is Internet facing and also running on 7.x

Workarounds:  

For each interface, remove the fgfm access, 

for example change :

config system interface

    edit "portX"

         set allowaccess ping https ssh fgfm

    next

end

to :

config system interface

    edit "portX"

         set allowaccess ping https ssh

    next

end

Note that this will prevent FortiGate discovery from FortiManager. Connections from the FortiGate will still work.

Please also note that a local-in policy that only allows FGFM connections from a specific IP will reduce the attack surface but it won't prevent the vulnerability from being exploited from this IP. As a consequence, this should be used as a mitigation and not as a complete workaround.

Reference:

https://www.bleepingcomputer.com/news/security/new-fortinet-rce-flaw-in-ssl-vpn-likely-exploited-in-attacks/

FG-IR-24-029 (Affected version: 7.x) (CVE-2024-23113) - (CVSS 9.8) - Fortinet Fortigate

FG-IR-24-015 (CVE-2024-21762) (CVSS 9.6) - Fortinet Fortigate firewall

Product Security Incident Response Team (PSIRT) advisory regarding our FortiOS. 

FG-IR-24-015: FortiOS - Out-of-bound Write in sslvpnd An out-of-bounds write vulnerability (CWE-787) in FortiOS could potentially allow a remote unauthenticated attacker to execute arbitrary code or commands through specially crafted HTTP requests.


Solution reference Link: https://www.fortiguard.com/psirt/FG-IR-24-015 

Workaround: Disable SSLVPN: https://community.fortinet.com/t5/FortiGate/Technical-Tip-nbsp-How-to-disable-SSL-VPN-functionality-on/ta-p/230801 

And also, the local in policy to enhance the SSL security should be considered:

Config firewall local-in-policy

Edit 4

Set intf "portx" (x is the port number for Public Internet)

Set srcaddr "trusted source IP"

Ste dstaddr "all"

Set action accept

Set service "SSLVPN_10443"

Set schedule "always"

Set status enable

Next

Edit 3

Set intf "portx" (x is the port number for Public Internet)

Set srcaddr "all"

Set dstaddr "all"

Set service "SSLVPN_10443"

Set action deny

Set schedule "always"

Set status enable

Next

end

There are several SSL VPN enhancements consideration:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Optional-security-considerations-for-FortiOS-SSL/ta-p/257561

For long term, you should plan for replace your SSL VPN to ZTNA:

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/78050/migrating-from-ssl-vpn-to-ztna

Reference:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-Allowing-access-to-the-FortiGate-SSL/ta-p/222845

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Optional-security-considerations-for-FortiOS-SSL/ta-p/257561

https://docs.fortinet.com/document/fortigate/6.4.1/administration-guide/726241/matching-geoip-by-registered-and-physical-location

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/78050/migrating-from-ssl-vpn-to-ztna

FG-IR-24-015 (CVE-2024-21762) (CVSS 9.6) - Fortinet Fortigate firewall

Fortinet Fortigate enable virtual patch to protect the firewall itself

Under Vdom > .root command prompt:

Virtual patching on the local-in management interface
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/393161

Fortinet Fortigate enable virtual patch to protect the firewall itself

Fortinet Fortigate Trusted host 10 entry limitation

Fortinet Fortigate Trusted host 10 entry limitation

Workaround:

Create another admin account to get additional 10 entry of trusted host 10 IP addresses / IP range

Fortinet Fortigate Trusted host 10 entry limitation

Fortinet Firewall Feature - Security Rating

Fortinet Security Rating required "Attack Surface Security Rating License" which is included in "Enterprise Protection Bundle" (FortiGuard Bundles)

Reference:

https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/292634/security-rating

Fortinet Firewall Feature - Security Rating

Fortinet Fortigate Firewall on Public Cloud

On Alicloud:

4 vCPU license is minimum requirement since the setup on alicloud is required 2vCPU per 1 network port. Since firewall is required 2 network port, you need to have 4 vCPU license. 

On Tencent Cloud:

No such requirement, you can start from 2 vCPU license.

Fortinet Fortigate Firewall on Public Cloud

Fortinet Fortigate add external Threat Feed

 Under global vdom, security fabric, external connectors:

Add TWO external Connector:

opendbl.net/lists/talos.list

opendbl.net/lists/tor-exit.list

Create TWO firewall rule, one is incoming and one is outgoing:

Reference:

https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/9463/threat-feeds

https://www.youtube.com/watch?v=CarI6_URN90

Fortinet Fortigate add external Threat Feed

Fortinet Fortigate - Virtual patching on the local-in management interface

Under Vdom > .root command prompt:

How to check the configuration is running?

Under global command promote:

reference:

Virtual patching on the local-in management interface

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/393161

Fortinet Fortigate - Virtual patching on the local-in management interface

A very good security feature on Fortinet Fortigate you should enable to protect your firewall against vulnerability

Virtual patching on the local-in management interface

Virtual patching is a method of mitigating vulnerability exploits by using the FortiGate's IPS engine to block known vulnerabilities. Virtual patching can be applied to traffic destined to the FortiGate by applying the FMWP (Firmware Virtual Patch) database to the local-in interface using local-in policies. Attacks geared towards GUI and SSH management access, for example, can be mitigated using the FMWP database pushed from FortiGuard, thereby virtually patching these vulnerabilities.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/393161/virtual-patching-on-the-local-in-management-interface

A very good security feature on Fortinet Fortigate you should enable to protect your firewall against vulnerability

FortiOS with External Threat Feed

FortiOS with External Threat Feed with NSFocus. The Build – 6.4.9 build 8978 beta buildis already support NsFocus Threat Feeds Integration by External Connectors.

FortiOS with External Threat Feed with Cisco Talos. https://opendbl.net/lists/talos.list

FortiOS did not support AlienVault TI.  Since the AlienVault TI API is unsupported.

But FortiSOAR is support AlienVault's for TI integration.

 

There are several free Open Dynamic Block Lists able to enhance your security:

https://opendbl.net/

FortiOS with External Threat Feed

Fortigate firewall add some bulid-in network monitor module to Dashboard

1. Add the “Dashboard” –> “Status”

2. Click “Widget”, then you will see a pop up like the following:

Click on the module you want to put on the dashboard.

It’s done.

Fortigate firewall add some bulid-in network monitor module to Dashboard

FortiGate – FortiGuard Web Filtering and URL Filtering

Web Filtering – FortiGuard Center for URL/IP Rating and Information Lookup

http://www.fortiguard.com/webfiltering/webfiltering.html

If the website have been blocked by FortiGuard Web Filtering, you will see the screen like the following:

 

You can also submit request to remove/re-category from the vendor DB if you think the website is mis-category.

http://url.fortinet.net/rate/submit.php

If the website have been blocked by URL filtering (which is defined by administrator), you will receive a screen like the following:

FortiGate – FortiGuard Web Filtering and URL Filtering