Fortigate to Fortigate VXLAN – Disaster Recovery

Been working on a solution for a disaster recovery one of the goals was a stretched layer 2 network. Since we would need a similar firewall with similar rules at the DR location I have been investigating vxlan over and IPSEC tunnel.

This is the current test config I will update it when more testing has been completed.

config sys global
 set hostname FIREWALL1
end

config system interface
    edit "wan1"
        set vdom "root"
        set mode static
        set ip 173.1.1.1 255.255.255.0
        set allowaccess ping fgfm
        set type physical
        set role wan
        set snmp-index 1
    next
end

config vpn ipsec phase1-interface
    edit "to_HQ2"
        set interface "wan1"
        set peertype any
        set net-device disable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set wizard-type static-fortigate
        set remote-gw 173.1.1.2
        set psksecret supersecret
    next
end
   
config vpn ipsec phase2-interface
    edit "to_HQ2"
        set phase1name "to_HQ2"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set comments "VPN: to_HQ2 (Created by VPN wizard)1"
        set src-addr-type ip
        set dst-addr-type ip
        set src-start-ip 1.1.1.1
        set dst-start-ip 1.1.1.2
    next
end


config system vxlan
    edit "vxlan1"
        set interface "to_HQ2"
        set vni 1000
        set remote-ip "1.1.1.2"
    next
end



config system interface
   edit "to_HQ2"
        set vdom "root"
        set ip 1.1.1.1 255.255.255.255
        set type tunnel
        set remote-ip 1.1.1.2 255.255.255.255
        set snmp-index 8
        set interface "wan1"
    next
   edit vlan100
     set vdom root
     set vlanid 100
     set interface dmz
   next
   edit vxlan100
     set type vlan
     set vlanid 100
     set vdom root
     set interface vxlan1
   next
end


config system switch-interface
  edit sw1
    set vdom root
    set member vlan100 vxlan100
  next
end
config system interface 
edit "sw1"
        set vdom "root"
        set ip 192.168.4.1 255.255.255.0
        set type switch
        set snmp-index 12
next
end
config router static
    edit 1
        set dst 1.1.1.2 255.255.255.255
        set device "to_HQ2"
    next
end


//////////  FIREWALL 2

config sys global
 set hostname FIREWALL2
end

config system interface
    edit "wan1"
        set vdom "root"
        set mode static
        set ip 173.1.1.2 255.255.255.0
        set allowaccess ping fgfm
        set type physical
        set role wan
        set snmp-index 1
    next
end

config vpn ipsec phase1-interface
    edit "to_HQ1"
        set interface "wan1"
        set peertype any
        set net-device disable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set wizard-type static-fortigate
        set remote-gw 173.1.1.1
        set psksecret supersecret
    next
end
   
config vpn ipsec phase2-interface
    edit "to_HQ1"
        set phase1name "to_HQ1"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set src-addr-type ip
        set dst-addr-type ip
        set src-start-ip 1.1.1.2
        set dst-start-ip 1.1.1.1
    next
end


config system vxlan
    edit "vxlan1"
        set interface "to_HQ1"
        set vni 1000
        set remote-ip "1.1.1.1"
    next
end



config system interface
   edit "to_HQ1"
        set vdom "root"
        set ip 1.1.1.2 255.255.255.255
        set type tunnel
        set remote-ip 1.1.1.1 255.255.255.255
        set snmp-index 8
        set interface "wan1"
    next

   edit vlan100
     set vdom root
     set vlanid 100
     set interface dmz
   next
   edit vxlan100
     set type vlan
     set vlanid 100
     set vdom root
     set interface vxlan1
   next
end


config system switch-interface
  edit sw1
    set vdom root
    set member vlan100 vxlan100
  next
end
config system interface 


edit "sw1"
        set vdom "root"
        set ip 192.168.4.2 255.255.255.0
        set type switch
        set snmp-index 12
next
end

config router static
    edit 1
        set dst 1.1.1.1 255.255.255.255
        set device "to_HQ1"
    next
end

Packet Capture without Wireshark

I needed to capture packets off a production web server but did not want to add additional unnecessary software to production like wireshark or similar.

I came across some dated articles on Netsh that looked promising. But the tool used to convert to packet capture seemed to be deprecated. Luckily the following tool allows you to convert ETL to packet capture so it can be opened in wireshark.

Here is a basic example.

netsh trace start capture=yes report=disabled
netsh trace stop

Copy the .etl file to a machine with wireshark.

etl2pcapng.exe NetTrace.etl out.pcapng

https://github.com/microsoft/etl2pcapng to convert the file.

Ultramarathon Man review

A quick entertaining read about Dean Karnazes, how he began running, and started ultra endurance racing. The book does a good job of detailing some of his bigger endurance feats, as you read about some of his overnight and extreme runs you start to realize that the human body is capable of so much more than we think.

Good motivational book to help you push through training plateaus.

Fortigate with Fortilink enabled switches that won’t upgrade

We had a number of Fortigate firewalls managing Fortiswitches via Fortilink, and no matter what version of Fortiswitch firmware we tried the switches would reboot but not upgrade. After some troubleshooting we found that using the following commands allowed the switches to be upgraded.

config switch-controller global
set https-image-push enable
end

Fortigate traffic sourced from wrong interface

Installed new Fortigate 61E’s, everything seemed to work as planned until I wanted to added Fortianalyzer for traffic analysis. Testing seemed to indicate that Fortianalyzer traffic was being sent out the WAN interface instead of the IPSEC tunnel. After searching around I found that a source ip needed to be set for traffic originating from the Fortigate for traffic like Fortianalyzer, syslog etc. The following config helped resolve.

config log fortianalyzer setting
set status enable
        set server x.x.x.x
set source-ip x.x.x.x
end

config log syslogd setting
     set status enable
     set server x.x.x.x
     set source-ip x.x.x.x

end