Skip to main content

Fortinet Fortigate NGFW Remediation Guide for Fingerprint - Network Security Check

Andrew Jonathan
  • Updated

Configuration guideline for Fortinet Fortigate Firewall - Mitigate Instant Security Check Tests

High Level Test Overview - Matching Features

High Level View of Licensing and Required Features for Mitigation:

  1. Browser Security - Local Browser Configuration - https://support.google.com/chrome/answer/95472?co=GENIE.Platform%3DDesktop&hl=en

  2. Network Access Protection - NGFW

    1. Block access to adult website - Web Filtering

    2. Block websites in embargoed countries - Geo IP

    3. Block access to anonymizing websites - Web Filtering

    4. Cross-Site Scripting Scanning Attempt via http, get - IPS

    5. Cross-Site Scripting Scanning Attempt via https, get - IPS

    6. JS Cryptojacking via http, get - IPS

    7. JS Cryptojacking via https, get - IPS

    8. SQL Injection in GET request via http - IPS

    9. SQL Injection in GET request via https - IPS

  3. Data Encryption - Local Browser Configuration and HTTPS Inspection

    1. Certificate Validation

    2. Broken Cryptography

    3. Domain Security Policies

    4. SSL inspection

  4. Online Privacy - Local Browser Configuration - Do Not track Option -https://support.google.com/chrome/answer/114836?co=GENIE.Platform%3DDesktop&hl=en

  5. Malware Protection - NGTP

    1. Download EICAR file via http - AntiVirus

    2. Download EICAR file via https - AntiVirus + SSLi

    3. Download EICAR text file via http - AntiVirus

    4. Download EICAR text file via https - AntiVirus + SSLi

    5. Download EICAR text file inside zip via http - AntiVirus

    6. Download EICAR text file inside zip via https - AntiVirus + SSLi

    7. Download EICAR file zipped 2 times via http - AntiVirus

    8. Download EICAR file zipped 2 times via https - AntiVirus + SSLi

    9. Download EICAR file zipped 5 times via http - AntiVirus

    10. Download EICAR file zipped 5 times via https - AntiVirus + SSLi

    11. Download EICAR file zipped with '123456' password via http - AntiVirus

    12. Download EICAR file zipped with '123456' password via https - AntiVirus + SSLi

    13. Download EICAR file zipped with 'password' password via http - AntiVirus

    14. Download EICAR file zipped with 'password' password via https - AntiVirus + SSLi

  6. Data Protection - DLP {CLI only after 6.2.2)

    1. SSN codes leak via https - DLP +SSLi

    2. SSN codes leak via http - DLP

    3. Local Country SSN code leak via https - DLP +SSLi

    4. Local Country SSN code leak via http - DLP

    5. Credit card numbers leak via https - DLP +SSLi

    6. Credit card numbers leak via http - DLP

    7. Source code (C) leak via https - DLP +SSLi

    8. Source code (C) leak via http - DLP

    9. SSH private key leak via https - DLP +SSLi

    10. SSH private key leak via http - DLP

Not all protections are covered by default configuration or signatures!

For SSL/HTTPS tests you would need to have HTTPS Inspection configured

Configuration for Fortinet Fortigate

Set-up a basic installation following the documentation here.

Make sure to activate the features according to the mapping at the beginning of the article, as follows:

You need to make sure the license includes both Web Filtering/Application Control and Threat Prevention fucntions.

In order to have the checks for HTTPS websites we would need to first configure HTTPS Inspection

References:

About: https://inside.fortinet.com/doku.php?id=fortigate:about_ssl_inspection

Admin Guide: https://docs2.fortinet.com/document/fortigate/6.4.2/administration-guide/929997/ssl-ssh-inspection

Select the Gateway and Navigate to the Security Profiles > SSL/SSH Inspection tab. Select deep-inspection profile and create a Clone. Rename this to the deep-inspection-custom profile.

Select and Edit the profile and make sure to Block Untrusted Certificates and inspect at least HTTPS Protocol. Also enable Exceptions in order to avoid issues with Update Services.

Make sure to export the CA certificate by clicking the Download Link. You can also import a certificate from your own CA but this needs to have the ability to create other certificates and sign them. Import the downloaded certificate into either “AD” Trusted Root or each local host Trusted Root certificate store.

For Chrome/Mozilla the procedure is a bit different and will be discussed in a dedicated article.

Once HTTPS Inspection is active you can check any HTTPS Site’s certificate when passing the Security Gateway. It should look like it was signed by the CA of the Fortigate Firewall.

Inspection Certificate versus Original Certificate.

Mitigation for Specific Tests

Network Access Protection - NGFW

Create a specific policy with all protections enabled

Navigate to Policy & Objects > Firewall Policy > Create New

Add a Rule to allow outbound DNS.

Add a Rule to Drop QUIC Protocol. QUIC needs to be defined as a Service object with UDP/443.

Add a Rule to Filter Outbound traffic with all Protections enabled.

Edit the Outbound rule and make sure to check that all Protections are enabled and that NAT is configured

Flow-based and Proxy-Based may yield different results, so sometimes it is better to select Proxy-Based

Block access to adult website

Navigate to Security Profiles > Web Filter > Edit the selected profile

Make sure to Block the Pornography Category.

Block websites in embargoed countries - Geo IP

Navigate to Firewall & Objects > Addresses > Define a Geography Type address and select the relevant Country,

Select Policy and define a block rule at the top of the rule base.

Block access to anonymizing websites

Navigate to Security Profiles > Web Filter > Edit the selected profile

Make sure to Block the Proxy Avoidance Category.

Cross-Site Scripting Scanning Attempt via http, get - IPS

Navigate to Policy & Objects > Firewall Policy > Edit the exiting policy and make sure that you select high-security profile for IPS

Also make sure to Block this signature: Cross.Site.Scripting

Cross-Site Scripting Scanning Attempt via https, get - IPS

Navigate to Policy & Objects > Firewall Policy > Edit the exiting policy and make sure that you select high-security profile for IPS

Also make sure to Block this signature: Cross.Site.Scripting

JavaScript Cryptominer via http, get - IPS

Navigate to Policy & Objects > Firewall Policy > Edit the exiting policy and make sure that you select high-security profile for IPS

JavaScript Cryptominer via https, get - IPS

Navigate to Policy & Objects > Firewall Policy > Edit the exiting policy and make sure that you select high-security profile for IPS

SQL Injection in GET request via http - IPS

Navigate to Policy & Objects > Firewall Policy > Edit the exiting policy and make sure that you select high-security profile for IPS

Also make sure to Block this signature: HTTP.URI.SQL.Injection

SQL Injection in GET request via https - IPS

Navigate to Policy & Objects > Firewall Policy > Edit the exiting policy and make sure that you select high-security profile for IPS

Also make sure to Block this signature: HTTP.URI.SQL.Injection

Data Encryption

Certificate Validation

Mitigated by default

Broken Cryptography

Mitigated by default

Domain Security Policies

Some tests may fail is HTTP/SSL Inspection is enabled and the device doing the MITM is not properly configured.

Note: This is normal behavior

SSL Inspection

config vpn certificate setting
set ocsp-status enable
set ocsp-option certificate

Note: Follow Fortinet KB for OSCP https://kb.fortinet.com/kb/documentLink.do?externalID=FD48218

Online Privacy

Do Not Track Option

More

  1. On your computer, open Chrome.

  2. At the top right, click More   Settings.

  3. Under "Privacy and security," choose what settings to turn off.

    1. To control how Chrome handles content and permissions for a site, click Site settings.

    2. To delete information from your browsing activity, like your history, cookies, or saved passwords, click Clear browsing data.

    3. To control how Chrome handles cookies and tracking, click Cookies and other site data.

    4. To manage safe browsing and protection, click Security

    5. Send a "Do Not Track" request with your browsing traffic: You can include a "Do Not Track" request with your browsing traffic. However, many websites will still collect and use your browsing data to improve security, provide content, services, ads and recommendations on their websites, and generate reporting statistics.

Malware Protection

  • Download EICAR file via http

  • Download EICAR file via https

  • Download EICAR text file via http

  • Download EICAR text file via https

  • Download EICAR file zipped 2 times via http

  • Download EICAR file zipped 2 times via https

For HTTPS checks make sure you have enabled HTTPS Inspection - detailed earlier in this guide.

To mitigate EICAR / Malicious files you need to enable Anti-Virus Feature as a minimum.

Navigate to Policy & Objects > Firewall Policy > Edit the exiting policy and make sure that you select Anti-Virus as active

  • Download EICAR file zipped 5 times via http

  • Download EICAR file zipped 5 times via https

  • Download EICAR file zipped with '123456' password via http

  • Download EICAR file zipped with '123456' password via https

  • Download EICAR file zipped with 'password' password via http

  • Download EICAR file zipped with 'password' password via https

For HTTPS checks make sure you have enabled HTTPS Inspection - detailed earlier in this guide.

To mitigate EICAR / Malicious files you need to enable Anti-Virus Feature as a minimum.

Navigate to Policy & Objects > Firewall Policy > Edit the exiting policy and make sure that you select Anti-Virus as active

Sometimes HTTPS does not detect the multiple zip or password archives. Sometimes clearing browser cache may resolve this

There is also a possibility that even though AV and IPS are working properly and the network is secured the EICAR test file that we are using is allowed. In order for the test to reflect thsi as dropped define EICAR action on IPS profile to be Block. Details in the screenshots below.

Data Protection

Data Loss Prevention Feature

Reference: https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/781717/dlp-filepattern

KB: https://kb.fortinet.com/kb/documentLink.do?externalID=FD46641

This entry has been removed in the GUI. All the config must be done from CLI

fg-vm # config dlp sensor

fg-vm # edit dlp_custom

fg-vm (dlp_custom) # show
config dlp sensor
edit "dlp_custom"
set comment "created for matching SSN and PCI DSS"
config filter
edit 1
set name "SSN"
set type message
set proto http-post
set filter-by ssn
set action block
next
edit 2
set name "PCI"
set type message
set proto http-post
set action block
next
edit 3
set name "SSN_LOCAL"
set proto http-post
set filter-by regexp
set regexp "[1-8]\d{2}(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])(0[1-9]|[1-4]\d|5[0-2]|99)\d{4}"
set action block
next
end
set extended-log enable
next
end

config firewall policy
edit 1
set name "OUTBOUND"
set uuid 151e4378-fc4b-51ea-f670-d968b3d77611
set srcintf "port2"
set dstintf "port1"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set utm-status enable
set inspection-mode proxy
set ssl-ssh-profile "deep-inspection-custom"
set av-profile "default"
set webfilter-profile "Clone of default"
set dnsfilter-profile "default"
set dlp-sensor "dlp_custom"
set file-filter-profile "Test"
set ips-sensor "high_security"
set application-list "default"
set nat enable
next
end

  • SSN codes leak via https

  • SSN codes leak via http

config filter
edit 1
set name "SSN"
set type message
set proto http-post
set filter-by ssn
set action block

  • Local Country SSN code leak via https

  • Local Country SSN code leak via http

edit 3
set name "SSN_LOCAL"
set proto http-post
set filter-by regexp
set regexp "[1-8]\d{2}(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])(0[1-9]|[1-4]\d|5[0-2]|99)\d{4}"
set action block
next

When entering regex make sure to use quote marks and escape special chars.

The test is sending more than one SSN so for this reason ^$ where taken out of the regex

  • Credit card numbers leak via https

  • Credit card numbers leak via http

edit 2
set name "PCI"
set type message
set proto http-post
set action block
next

  • Source code (C) leak via https

  • Source code (C) leak via http

Not mitigated by default as Fortinet does not provide a Source code filter

'#include <iostream.h>\r\n#include "functions.h"\r\nint main(){\r\nprint_hello();\r\ncout << endl;\r\ncout << "The factorial of 5 is " << factorial(5) << endl;\r\nreturn 0;\r\n}\r\n',description: 'Source code (C)',

Example simple REGEX to match C libraries:

edit 5
set filter-by regexp
set regexp "((#){1}include(\ ){1}[<"]{1}[a-z]+(.h){1}[>"]{1})+"
set name "CCODE"
set proto http-post
set filter-by regexp
set action block
next

Need to define specific regex in order to match the above payload

  • SSH private key leak via https

  • SSH private key leak via http

edit 4
set name "PKEY"
set proto http-post
set filter-by regexp
set regexp "(-){5}BEGIN\ RSA\ PRIVATE\ KEY(-){5}(.*){1}(-){5}END\ RSA\ PRIVATE\ KEY(-){5}"
set action block
next

Results after configuration is according to this guide:

Related articles

Comments

0 comments

Please sign in to leave a comment.