Comandos FORTINET

Fortinet Firewall Commands

// Health and Status

show [enter] //Note that output is only non-default values.
show full-configuration // Show all configurations on the device.
show system interface wan1 | grep -A2 ip // Show WAN and interface information.
get system info admin status // Show logged in users
get system status // Show system hardware/software update versions
get hardware status // Detailed hardware model information
get system performance status
get system performance top
show system interface // Interface Configuration
diagnose hardware deviceinfo nic // Interface Statistics/Settings
diagnose hardware sysinfo memory
diag debug crashlog read
diag hardware sysinfo shm // Device should be in 0, if (>0) then conservemode
get system global | grep -i timer // Show tcp and udp timers for halfopen and idle
get system session-ttl // System default tcp-idle session timeout
execute ha manage <devid> // send heartbeat accross management link.
get hardware nic
diagnose ip address list
get system interface physical

// ARP

diagnose ip arp list

// Track and Troubleshoot
get system session status // Connection count for ingress/egress
get system session-info full-stat // Displays session status with breakdown by state
get system session list // Session list, protocol, expire, src nat, dst nat
diag sys session // Basic output with no filters of diag sys session
diag sys session filter <option> <value> // Capture filter based on src, dst, duraction, policy id, vd

// Packet capture

diag debug info // Displays active debug
diag debug enable // Enable debug

#diagnose debug flow filter (shows what filters are configured)
#diagnose debug flow filter clear (clear all filter)
#diagnose debug flow filter <options> <value> (configures the filter)
#diagnose debug flow show con enable <show output on console>
#diagnose debug flow show fun enable <show functions>
#diagnose debug flow trace start <number of lines> (to start the trace)
#diagnose debug flow trace stop (to stop the trace)

Example:
diagnose debug reset
diagnose debug enable
diagnose debug flow filter clear
diagnose debug flow filter saddr 192.168.10.1
diagnose debug flow filter dport 80
diagnose debug flow show con enable
diagnose debug flow show fun enable
diagnose debug flow trace start 20

diagnose sniffer packet <interface or ANY> ‘<arguments>’ <level 1-6>

example:
diagnose sniffer packet ANY ‘net 192.168.10.0/24 and not host 192.168.10.1 and port 80 and TCP’ 6

Syn packets only:
diag sniffer packet internal ‘tcp[13] == 2'

to stop:
diagnose debug reset
diagnose debug disable

// Enable packet capture in GUI

System -> Config -> Advanced
Setup packet capture filter, Check box to start, Uncheck to stop.
Download Debug Log

by Jonathan Rennie

http://stackfire.com/fortigate-cli-comandos-utiles-i/
http://kb.fortinet.com/kb/documentLink.do?externalID=FD36793

get sys status
diagnose hardware sysinfo memory
diagnose hardware sysinfo shm
diagnose ips dissector status
get sys perf status
diag sys session full-stat
diag sys session6 full-stat
dia netlink device list
dia test app http 4
dia test app proxyworker 4
diag firewall statistic show
diag firewall packet distribution
dia stats per-ip-bw
diagnose hardware sysinfo shm
diag sys top

GUIA RÁPIDA PARA LA ACTUALIZACIÓN DE LA PLATAFORMA DE SEGURIDAD JUNIPER. (HA)

ALISTAMIENTO

1.       Ingresar al firewall via ssh

2.       Validar la versión del equipo

·         show versión

3.       Validar estado del cluster

·         show chassis cluster status

·         show chassis cluster interfaces

4.       Realizar respaldo de la configuración del equipo.

·         show configuration | display set | no-more 

5.       Realizar limpieza de memoria en cada uno de los nodos del clúster.

·         request system storage cleanup

6.       Verificar espacio disponible. (/cf/var)

·         show system storage

7.       Copiar la imagen a la carpeta elegida del nodo principal. (/cf/var/tmp)

·         Ingresar al firewall via ftp y copiar la imagen. (recomendable con winsSCP)

·         Validar que la imagen este en la carpeta, file list /cf/var/tmp detail | match junos

8.       Ingresar vía ssh al firewall y copiar la imagen del nodo principal al de respaldo.

·         file copy  /cf/var/tmp/junos-srxsme-xxxxxx-domestic.tgz  node0:/cf/var/tmp

ACTUALIZACION

1.       Ingresar via ssh al nodo principal

2.       Ingresar al nodo de respaldo:

a.       > start Shell

b.      % rlogin -T noed0  ènode0 o node1, según sea el caso.

3.       Cargar la imagen sobre el firewall de respaldo

a.       request system software

4.       Ingresar al nodo principal en una segunda session via ssh

5.       Cargar la imagen sobre el firewall principal

a.       request system software

6.       Reinicar nodo de respaldo

a.       request system reboot

7.       Reiniciar nodo principal

a.       request system reboot

VALIDACION

1.       Ingresar al firewall via ssh

2.       Validar la versión del equipo

a.       show versión

3.       Validar estado del cluster

a.       show chassis cluster status

b.      show chassis cluster interfaces

vpn juniper parte 3

Verificando el estado de la VPN

Verifying the IKE Phase 1 Status	show security ike security-associations
	show security ike security-associations index (number) detail
Verifying the IPsec Phase 2 Status	show security ipsec security-associations
	show security ipsec security-associations index (number) detail
	show security ipsec statistics index (number)

VPN JUNIPER PARTE 2

Tomando como referencia un ejemplo de jumiper.

VPN Juniper

Requirements	Policy-Based VPN
Configuring Interface, Static Route, Security Zone, and Address Book Information	set interfaces ge-0/0/0 unit 0 family inet address 10.10.10.1/24
	set interfaces ge-0/0/3 unit 0 family inet address 1.1.1.2/30
	set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1
	set security zones security-zone untrust interfaces ge-0/0/3.0
	set security zones security-zone untrust host-inbound-traffic system-services ike
	set security zones security-zone trust interfaces ge-0/0/0.0
	set security zones security-zone trust host-inbound-traffic system-services all
	set security address-book book1 address sunnyvale 10.10.10.0/24
	set security address-book book1 attach zone trust
	set security address-book book2 address chicago 192.168.168.0/24
	set security address-book book2 attach zone untrust
Configuring IKE	set security ike proposal ike-phase1-proposal authentication-method pre-shared-keys
	set security ike proposal ike-phase1-proposal dh-group group2
	set security ike proposal ike-phase1-proposal authentication-algorithm sha1
	set security ike proposal ike-phase1-proposal encryption-algorithm aes-128-cbc
	set security ike policy ike-phase1-policy mode main
	set security ike policy ike-phase1-policy proposals ike-phase1-proposal
	set security ike policy ike-phase1-policy pre-shared-key ascii-text 395psksecr3t
	set security ike gateway gw-chicago external-interface ge-0/0/3.0
	set security ike gateway gw-chicago ike-policy ike-phase1-policy
	set security ike gateway gw-chicago address 2.2.2.2
Configuring IPsec	set security ipsec proposal ipsec-phase2-proposal protocol esp
	set security ipsec proposal ipsec-phase2-proposal authentication-algorithm hmac-sha1-96
	set security ipsec proposal ipsec-phase2-proposal encryption-algorithm aes-128-cbc
	set security ipsec policy ipsec-phase2-policy proposals ipsec-phase2-proposal
	set security ipsec policy ipsec-phase2-policy perfect-forward-secrecy keys group2
	set security ipsec vpn ike-vpn-chicago ike gateway gw-chicago
	set security ipsec vpn ike-vpn-chicago ike ipsec-policy ipsec-phase2-policy
Configuring Security Policies	set security policies from-zone trust to-zone untrust policy vpn-tr-untr match source-address sunnyvale
	set security policies from-zone trust to-zone untrust policy vpn-tr-untr match destination-address chicago
	set security policies from-zone trust to-zone untrust policy vpn-tr-untr match application any
	set security policies from-zone trust to-zone untrust policy vpn-tr-untr then permit tunnel ipsec-vpn ike-vpn-chicago
	set security policies from-zone trust to-zone untrust policy vpn-tr-untr then permit tunnel pair-policy vpn-untr-tr
	set security policies from-zone untrust to-zone trust policy vpn-untr-tr match source-address chicago
	set security policies from-zone untrust to-zone trust policy vpn-untr-tr match destination-address sunnyvale
	set security policies from-zone untrust to-zone trust policy vpn-untr-tr match application any
	set security policies from-zone untrust to-zone trust policy vpn-untr-tr then permit tunnel ipsec-vpn ike-vpn-chicago
	set security policies from-zone untrust to-zone trust policy vpn-untr-tr then permit tunnel pair-policy vpn-tr-untr
	set security policies from-zone trust to-zone untrust policy permit-any match source-address any
	set security policies from-zone trust to-zone untrust policy permit-any match destination-address any
	set security policies from-zone trust to-zone untrust policy permit-any match application any
	set security policies from-zone trust to-zone untrust policy permit-any then permit
	insert security policies from-zone trust to-zone untrust policy vpn-tr-untr before policy permit-any
Requirements	Route-Based VPN
Configuring Interface, Static Route, Security Zone, and Address Book Information	set interfaces ge-0/0/0 unit 0 family inet address 10.10.10.1/24
	set interfaces ge-0/0/3 unit 0 family inet address 1.1.1.2/30
	set interfaces st0 unit 0 family inet address 10.11.11.10/24
	set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1
	set routing-options static route 192.168.168.0/24 next-hop st0.0
	set security zones security-zone untrust interfaces ge-0/0/3.0
	set security zones security-zone untrust host-inbound-traffic system-services ike
	set security zones security-zone trust interfaces ge-0/0/0.0
	set security zones security-zone trust host-inbound-traffic system-services all
	set security zones security-zone vpn-chicago interfaces st0.0
	set security address-book book1 address sunnyvale 10.10.10.0/24
	set security address-book book1 attach zone trust
	set security address-book book2 address chicago 192.168.168.0/24
	set security address-book book2 attach zone untrust
Configuring IKE	set security ike proposal ike-phase1-proposal authentication-method pre-shared-keys
	set security ike proposal ike-phase1-proposal dh-group group2
	set security ike proposal ike-phase1-proposal authentication-algorithm sha1
	set security ike proposal ike-phase1-proposal encryption-algorithm aes-128-cbc
	set security ike policy ike-phase1-policy mode main
	set security ike policy ike-phase1-policy proposals ike-phase1-proposal
	set security ike policy ike-phase1-policy pre-shared-key ascii-text 395psksecr3t
	set security ike gateway gw-chicago external-interface ge-0/0/3.0
	set security ike gateway gw-chicago ike-policy ike-phase1-policy
	set security ike gateway gw-chicago address 2.2.2.2
Configuring IPsec	set security ipsec proposal ipsec-phase2-proposal protocol esp
	set security ipsec proposal ipsec-phase2-proposal authentication-algorithm hmac-sha1-96
	set security ipsec proposal ipsec-phase2-proposal encryption-algorithm aes-128-cbc
	set security ipsec policy ipsec-phase2-policy proposals ipsec-phase2-proposal
	set security ipsec policy ipsec-phase2-policy perfect-forward-secrecy keys group2
	set security ipsec vpn ike-vpn-chicago ike gateway gw-chicago
	set security ipsec vpn ike-vpn-chicago ike ipsec-policy ipsec-phase2-policy
	set security ipsec vpn ike-vpn-chicago bind-interface st0.0
Configuring Security Policies	set security policies from-zone trust to-zone vpn-chicago policy vpn-tr-chi match source-address sunnyvale
	set security policies from-zone trust to-zone vpn-chicago policy vpn-tr-chi match destination-address chicago
	set security policies from-zone trust to-zone vpn-chicago policy vpn-tr-chi match application any
	set security policies from-zone trust to-zone vpn-chicago policy vpn-tr-chi then permit
	set security policies from-zone vpn-chicago to-zone trust policy vpn-chi-tr match source-address chicago
	set security policies from-zone vpn-chicago to-zone trust policy vpn-chi-tr match destination-address sunnyvale
	set security policies from-zone vpn-chicago to-zone trust policy vpn-chi-tr match application any
	set security policies from-zone vpn-chicago to-zone trust policy vpn-chi-tr then permit

Configuracion de VPN en Juniper

Vamos a empezar con una gráfica a ver como nos va.

VBSCRIPT: COPIA DE CONFIGURACIONES A UN TFTP

VBSCRIPT: COPIA DE CONFIGURACIONES A UN TFTP

Automatización para copiar el archivo de configuración de varios switch dell ,en este caso a un servidor tftp utilizando  un script .vbs y el Secure crt.

Como material de referencia tome información de los siguientes enlaces:

http://foro.elhacker.net/scripting/tutorial_vbscript-t229032.0.html

http://loquehayenmedio.blogspot.com/search/label/VBScript

Para la ejecución dl script inicio sesión en un router utilizando el secureCRT y busco el scritp previa mente guardado.

Acá dejo el archivo el cual se edita en un archivo de texto y se guarda con la extensión .vbs :

Básicamente explico las variables para poder ejecutar el script, en lo enlaces anteriores esta la información de las características de programación.

*************************************************************************

#$language = "VBScript"

#$interface = "1.0"

                Sub Main

                Const username = "USUARIO" ' Usuario que utilizara para conectarse al switch

                Const password = "CONTRASEÑA" ' Contraseña válida para el USUARIO

                Const passenable = "CONT-ENABLE" ' Contraseña enable  de ser requerido

                const yes = "y"

                Const DEVICE_FILE_PATH = "E:\IP.TXT" 'Archivo  con direccionamiento IP

                Const DEVICE_FILE_PATH2 = "E:\CONFIGURACION.TXT"   'Archivo nombres para guardar las configuraciones.

   

                Dim fso

                Set fso = CreateObject("Scripting.FileSystemObject")  'Creacion de objeto para el archivo IP.

                Dim fso2

                Set fso2 = CreateObject("Scripting.FileSystemObject") 'Creacion de objeto para el archivo CONFIGURACION

                Dim fil

                Set fil = fso.OpenTextFile(DEVICE_FILE_PATH) 'Variable

                Dim fil2

                Set fil2 = fso.OpenTextFile(DEVICE_FILE_PATH2)

                Dim ip ' variable para llamar la ip del switch

                Dim ip2 'variable para llamar el nombre del archivo (como va a quedare guardado en el tftp)

                Dim line

                Dim line2

                Dim cnxnString

   

                While Not fil.AtEndOfStream

                line = fil.ReadLine   ' forma como se leera el archivo

                line2 = fil2.readline

                 ip = Split(line, ";")(0)  'sintaxis para llamar la ip

               

                 ip2 = Split(line2, ";")(0) 'sintaxis para llamar el nombre del archivo

                cnxnString = "TELNET " & ip & "23"

                crt.Screen.Send "telnet " & ip & chr(13)  'formato para ejecutar las sentencias cli

                crt.Screen.WaitForString "User:"

                crt.Screen.Send username

                crt.Screen.Send vbCr

                crt.Screen.WaitForString "Password:"

                 crt.Screen.Send password

                crt.Screen.Send vbCr

                crt.Screen.WaitForString ">"       

                crt.Screen.Send vbCr

                crt.Screen.Send " enable" & chr(13)

                crt.Screen.Send passenable

                crt.Screen.Send vbCr

                crt.Screen.Send "copy running-config startup-config" & chr(13) ´comando a enviar

                crt.Screen.WaitForString "(y/n)" 'lo que esperamos que salga

                crt.Screen.Send yes 'la respuesta que damos

                crt.Screen.Send vbCr 'espera para enviar el siguiente comando

                crt.Screen.Send "copy running-config backup-config" & chr(13)

                crt.Screen.WaitForString "(y/n)"

                crt.Screen.Send yes

                crt.Screen.Send vbCr

                crt.Screen.Send "copy running-config tftp://192.168.5.55/" & ip2 & chr(13)

                crt.Screen.WaitForString "(y/n)"

                crt.Screen.Send yes

                crt.Screen.Send vbCr

                crt.Screen.Send "q" & chr(13)

                crt.Screen.Send vbCr

                crt.Screen.WaitForString "closed by foreign host]"

                 Wend

    fil.Close

End Sub

*****************************************************************************

IP.TXT

192.168.1.1;

192.168.2.1;

192.168.3.1;

****************************************************************************

CONFIGURACION.TXT

SWITCH1;

SWITCH2;

SWITCH3;

*****************************************************************************