Layer 3 Security

Recommendation
1. Enable secure Telnet access to a router and use SSH
2. Enable SNMP security, adding SNMPv3 support
3. Turn off unnecessary services on the router platform
4. Turn on logging to provide on audit trail
5. Enable protocol authentication
6. Enable CEF

General Layer3 Security Considerations

1. Smurf Attacks

– a large number of ICMP Echo Requires with same typical IP address in the packet
– the destination address is a subnet broadcast address, also known as a direct broadcast address

Solutions

Router & Switch Device Security

– to encrypt passwords with the following command #service password-encryption
– “#no service password-encryption” – does not automatically decrypt the password. It waits until a new password is added.
– #enable secret – encrypts the password as md5
– #enable password – type 7 password
– #username password <pass> – encrypts the password as MD5

AAA – Authentication, Authorization and Accounting

Radius vs Tacacs

Below are some notes from my CCIE written. Hope you enjoy them

MPLS IP Forwarding: Data Plane

– MPLS routers inject (push) or remove (pop) or forwards packets based on labels
– MPLS relies on the CEF while expanding the logic and data structures as well

LSR (Label Switch Router)

– any router that has awareness of MPLS Labels
FIB – used for incoming unlabled packets
LFIB – used for incoming labeled packets

MPLS header and Label
– header of 4 bytes, located before the IP header

MPLS header
[singlepic id=18 w=320 h=240 float=]

Hello,

It seems there is a new error that i found on a few Fortigate firewalls: CFG_CMDBAPI_ERR

To fix the issue you can do 2 things:

1. Upgrade the Fortigate to the latest version

2. Reboot the IPS of the Fortigate (this is was it causing the issue). Below is the command(through CLI):

diagnose test application ipsmonitor 99

Hope it helps!

Hello,

I have found the following video on Youtube that presents the FortiOS 5 in 5 minutes.

The new features look really good.

Check it out:

httpv://www.youtube.com/watch?v=H9UtpYOwlgk

What do you think?!

Changed the theme of the blog. You like ? 🙂

Thinking of creating a forum as i think it is highly needed for Fortigate firewall and other niche devices like Riverbed.

What do you think?

Hello,

I have a list of websites that i often search to find solutions or news about Fortinet.
Below is the link list, with some description:

1. www.ipspace.eu -> Yea, i often use this if i forget some troubleshooting commands
2. kb.fortinet.com -> A lot of good articles related to Fortigate problems
3. docs.fortinet.com -> A list with all the FREE books Fortinet provides for its different appliances
4. emea.fortinet.net/fortinet/troubleShooting.php -> used for Hardware Troubleshooting
5. url.fortinet.net/rate/submit.php -> If you found an URL that is put in a wrong category, here you can request a fix
6. campus.training.fortinet.com -> here you can find a lot of useful and FREE Fortigate webinars

That is it.

Hope you enjoy them.

Well,

It seems that Cisco launched the CCIE Security new lab blueprint.

Links to both the new v4 blueprint and v4 hardware/software equipment list, as well as a more detailed checklist for studying:

CCIE Security v4 Blueprint

CCIE Security v4 Equipment List

CCIE Security v4 Checklist

Hope you guys are not far with your CCIE Security studies..i know i am not.

Hello,

In this post i will show you how to create a policy based Fortigate VPN. I will be using FortiOS version 4.0 MR3.

For the VPN tunnel we used the following topology:

Creating Fortigate VPN Steps:

I. Go to VPN > IPsec ->Auto Key (IKE) and select “Create Phase 1“

Hi Guys,

I was thinking of creating a forum for Fortigate/Riverbed or any other IT issues ?

What do you think ?