Category Archives: Memorandum

Posts with the category “Memo” contain no new stuff for the Internet community but provide some useful aggregations of information for certain IT related things.

Network Transfer: 1 Big vs. 100 Small Files

Bandwidth/Delay, Memorandum, , , , , , , , ,

A common mistake when analyzing network speed/bandwidth between different applications and servers is to fully rely on the mere size of the files being transferred. In fact, one big file will transfer much faster than thousands of small files that have the same accumulated size. This depends on the overhead of reading/writing these files, building TCP/IP sessions, scanning them for viruses, etc. Furthermore, it is application dependent.

I built a small lab with an FTP server, switch, firewall, and an FTP client in which I played a bit with different file sizes. In this blog post I am showing the measured transfer times and some Wireshark graphs.

Continue reading Network Transfer: 1 Big vs. 100 Small Files →

ntopng Installation

Linux, Monitoring, Network, Tutorial/Howto, , , , , , ,

Some time ago I published a post introducing ntopng as an out-of-the-box network monitoring tool. I am running it on a Knoppix live Linux notebook with two network cards. However, I have a few customers that wanted a persistent installation of ntopng in their  environment. So this is a step-by-step tutorial on how to install ntopng on a Ubuntu server with at least two NICs.

Continue reading ntopng Installation →

Tufin SecureTrack: Adding Devices

Tufin, Tutorial/Howto, , , , , , , , ,

Since a few weeks I am using Tufin SecureTrack in my lab. A product which analyzes firewall policies about their usage and their changes by administrators (and much more). Therefore, the first step is to connect the firewalls to SecureTrack in two directions: SSH from SecureTrack to the device to analyze the configuration, as well as Syslog from the device to SecureTrack to real-time monitor the policy usage.

This blog post shows the adding of the following firewalls into Tufin: Cisco ASA, Fortinet FortiGate, Juniper ScreenOS, and Palo Alto PA.

Continue reading Tufin SecureTrack: Adding Devices →

MRTG/Routers2: Template FortiGate

Fortinet, MRTG/Routers2, Template, , , , , ,

A few weeks ago I constructed an MRTG/Routers2 template for the Fortinet FortiGate firewalls. I am using it for monitoring the FortiGate from my MRTG/Routers2 server. With the basic MRTG tool “cfgmaker” all graphs for the interfaces are generated automatically. My template is an add-on that appends graphs for CPU, memory, and disk usage, as well as connections and VPN statistics. Furthermore, it implements the ping statistics graph and a “short summary”, which only shows the system relevant graphs.

Continue reading MRTG/Routers2: Template FortiGate →

CLI Commands for Troubleshooting FortiGate Firewalls

Fortinet, Memorandum, , , , , ,

This blog post is a list of common troubleshooting commands I am using on the FortiGate CLI. It is not complete nor very detailled, but provides the basic commands for troubleshooting network related issues that are not resolvable via the GUI. I am not focused on too many memory, process, kernel, etc. details. These must only be used if there are really specific problems. I am more focused on the general troubleshooting stuff. I am using it personally as a cheat sheet / quick reference and will update it from time to time.

Continue reading CLI Commands for Troubleshooting FortiGate Firewalls →

Basic IPv6 Configuration on a FortiGate Firewall

Fortinet, IPv6, Memorandum, Template, , , , , , ,

It’s really great that the FortiGate firewalls have a DHCPv6 server implemented. With this mandatory service, IPv6-only networks can be deployed directly behind a FortiGate because the stateless DHCPv6 server provides the DNS server addresses. (This is unlike Palo Alto or Cisco which have no DHCPv6 server implemented.)

UPDATE: In the meantime Fortinet has implemented the RDNSS and DNSSL options as well. Great. Hence you don’t need DHCPv6 at all anymore to run an IPv6-only network. I updated my listings below as well.

However, the configuration on the FortiGate is really bad because nothing of the IPv6 features can be set via the GUI. (And this is called a Next-Generation Firewall? Not only the features count, but also the usability!) Everything must be done through the CLI which is sometimes hard to remember. Therefore I am publishing this memo of the appropriate CLI configuration commands.

Continue reading Basic IPv6 Configuration on a FortiGate Firewall →

FortiGate 2-Factor Authentication via SMS

Authentication, Fortinet, Password, Tutorial/Howto, , , ,

Two-factor authentication is quite common these days. That’s good. Many service providers offer a second authentication before entering their systems. Beside hardware tokens or code generator apps, the traditional SMS on a mobile phone can be used for the second factor.

The FortiGate firewalls from Fortinet have the SMS option built-in. No feature license is required for that. Great. The only thing needed is an email-to-SMS provider for sending the text messages. The configuration process on the FortiGate is quite simple, however, both the GUI as well as the CLI are needed for that job. (Oh Fortinet, why aren’t you improving your GUI?)

Here is a step-by-step configuration tutorial for the two-factor authentication via SMS from a FortiGate firewall. My test case was the web-based SSL VPN portal.

Continue reading FortiGate 2-Factor Authentication via SMS →

Juniper ScreenOS: DHCPv6 Prefix Delegation

DHCP/DHCPv6, IPv6, Juniper Networks, Routing, Tutorial/Howto, , , , , , , ,

The Juniper ScreenOS firewall is one of the seldom firewalls that implements DHCPv6 Prefix Delegation (DHCPv6-PD). It therefore fits for testing my dual stack ISP connection from Deutsche Telekom, Germany. (Refer to this post for details about this dual stack procedure.)

It was *really* hard to get the correct configuration in place. I was not able to do this by myself at all. Also Google did not help that much. Finally, I opened a case by Juniper to help me finding the configuration error. After four weeks of the opened case, I was told which command was wrong. Now it’s working. ;) Here we go.

Continue reading Juniper ScreenOS: DHCPv6 Prefix Delegation →

Policy Based Forwarding on a Palo Alto with different Virtual Routers

Palo Alto Networks, Routing, Tutorial/Howto, , , , ,

This guide is a little bit different to my other Policy Based Forwarding blog post because it uses different virtual routers for both ISP connections. This is quite common to have a distinct default route for both providers. So, in order to route certain traffic, e.g., http/https, to another ISP connection, policy based forwarding is used.

Continue reading Policy Based Forwarding on a Palo Alto with different Virtual Routers →

Policy-Based Routing on ScreenOS with different Virtual Routers

Juniper Networks, Routing, Tutorial/Howto, , , , , ,

I already puslished a blog post concerning policy-based routing on a Juniper firewall within the same virtual router (VR). For some reasons, I was not able to configure PBR correctly when using multiple VRs. Now it works. ;) So, here are the required steps:

Continue reading Policy-Based Routing on ScreenOS with different Virtual Routers →

Roundcube Installation Guide

Linux, Tutorial/Howto, , , , , , , , , ,

Roundcube is an email webclient which is easy and intuitive to use. I am using it for my private mails, connecting via IMAP and SMTP to my hoster. One of the great advantages is the “flag” option which is synchronized via IMAP to my Apple devices.

Following is a step-by-step installation guide for Roundcube plus an update scenario. It is a kind of “memo for myself”, but hopefully, others can use it as well.

Continue reading Roundcube Installation Guide →

Policy Routing on a FortiGate Firewall

Fortinet, Routing, Tutorial/Howto, , , , , , ,

This is a small example on how to configure policy routes (also known as policy-based forwarding or policy-based routing) on a Fortinet firewall, which is really simple at all. Only one single configuration page and you’re done. ;)

Continue reading Policy Routing on a FortiGate Firewall →

Yet another ownCloud Installation Guide

Linux, Tutorial/Howto, , , , , , , , , , ,

If you want to use you own ownCloud installation, you can find several documentation on the Internet on how to set up this server, e.g. the official ownCloud documentation, or installation guides such as this or that or here. But none of these page alone provided enough information for installing a secure server completely from the beginning.

So here comes my step-by-step guide which surely won’t be complete, too. ;) However, hopefully it will help other people while searching for their way to install ownCloud. Additionally I am showing how to upgrade an ownCloud server.

Continue reading Yet another ownCloud Installation Guide →

Out of the Box Network Analyzer “ntopng”

Linux, Memorandum, Monitoring, Network, , , , , ,

Some time ago I installed a new firewall at the customer’s site. Meanwhile the customer was interested in the flows that are traversing through the firewall right now. Oh. Good question. Of course it is easy to filter through log messages of firewalls, but theses logs are only for finished sessions. Yes, there are “session browsers” or the like on all firewalls, but they are not nice and handy to analyze the sessions in real-time.

The solution was to bring a network analyzer on a mirror port near to the firewall. I decided to use ntopng running on the live Linux distribution Knoppix. Great choice! An old notebook with two network adapters fits perfectly. A handful commands and you’re done:

Continue reading Out of the Box Network Analyzer “ntopng” →