ForiGate Internals: fresh information on Fortinet hardware and software

FortiOS 4.0 is here!

noreply@blogger.com (blogger) — Mon, 09 Mar 2009 16:34:00 +0000

Long-awaited FortiOS 4.0 is finally published on the Support FTP. Brief list of new features:

Redesigned web UI
Supports Data Leak Prevention (DLP) Feature
DHCP over IPSec Interface Support
Supports Power Supply Monitoring
WCCP v2 Support
SNMPv3 Support
Customized GUI Control
Enhanced Load Balance Feature
Supports WAN Optimization and Web Cache Feature
Redesigned SSL-VPN Web Portal
Supports HTTP POST Blocking
Supports Rogue Access Point Detection Feature
Supports Addition web UI Widgets
Supports Identity Based Firewall Policies
Supports Policy Based Traffic Shaping
Support for IPv6 Intrusion Protection
Supports "ANY" Interface for Firewall Policies.
Supports Administration over Modem Interface
Enhanced Central Management Communication Model
Redesigned IPS Feature
RADIUS Feature Enhancements
Enhanced Application Control Feature
Configurable VDOM Resource Limits
Redesigned SNMP MIBS
Logging Improvements
Introduction of AntiSpam Engine
Endpoint Control Feature
SSL Content Scanning and Inspection
Administration Over Modem
Network Access Control (NAC) Quarantine

We will cover these features in details in coming days...

FortiGate-110C Is Coming To Town

noreply@blogger.com (blogger) — Mon, 22 Sep 2008 14:25:00 +0000

After Fortinet updated SOHO and Enterprise solutions with FortiGate-50B/60B and FortiGate-310B most of us were waiting for some SMB solution to fit in the middle. One of the main problem of mid-class products of Fortinet was absence of Gigabit Ethernet ports on SMB devices. Also price/performance of FortiGate-100A and 200A was quite poor when compared to 60B model.

Recently we found on few sites information regarding upcoming FortiGate-110C model that should fill in the gap...

So in short FG-110C will have:

2 x 10/100/1000 Ethernet Ports
8 x 10/100 Ethernet Ports
Firewall Performance - 500Mbps
IPS Performance - 200Mbps
VPN Performance - 100Mbps (and 1500 IPSec VPN tunnels)
Antivirus Performance - 65Mbps
Number of sessions - 400,000 (10,000 new sessions/second)

When combined together these features provide unique combination that will allow Fortinet to better compete in the SMB segment. However low performance numbers on FW/VPN will limit the impact of new product launch as most of FW/VPN vendors already have the same horsepower in much smaller and cheaper devices. Let's hope that Fortinet intentionally left 200's index free and we will see a 200A's replacement quite soon.

There is no official pricing available yet, but some of the sites are already offering it at less than 2000 GBP including 1-Year Bundle Support.

Preliminary datasheet is available here or here.

FortiGate FortiOS 3.0 MR7 is comming...

noreply@blogger.com (blogger) — Tue, 08 Jul 2008 07:51:00 +0000

According to our information FortiOS 3.0 Maintenance Release is scheduled for July 2008, be ready! We just got an information on new features to be included in MR7:

AMC Cards configuration support: you can configure AMC card parameters even when card is unplugged.
USB modems support extended from SOHO models only to all models - that means that you can use 3G/HSDPA/EV-DO backup with any FG unit (just make sure that your USB modem is compatible with FortiOS).
ToS-based routing: you can specify routing according to the Type-of-Service bits of IP Packet when using Policy Based Routing.
L2TP VPN Client support.
E-mail archiving to FortiGuard Analysis&Management Service in addition to dedicated FortiAnalyzer appliance.
Single Sign-On (FSAE) Extensions: Novell E-Directory is supported in addition to Microsoft Active Directory. Also AD integration was updated in order to provide support for users with fast changing IP addresses.
SSL VPN Client Standalone installer is provided as an option instead of ActiveX control on the Web Portal
SSL VPN client now supports Linux and MacOS in addition to Windows
MR7 got a IPv6 "Phase 2" ready, ICSA SSL-VPN and Microsoft FSAE Certifications.

FortiMail 3.0 MR3 - Better Stats, MTA & Spam Engine

noreply@blogger.com (blogger) — Tue, 22 Apr 2008 07:53:00 +0000

Fortinet recently Released a Maintenance Release 3 for FortiMail 3.0 with many new features improving statistics display, mail storage & forwarding enhancements and new spam defence mechanisms.

System Enhancements:

Real Time Email Statistics Mail statistics can now be displayed in real time with historical hourly, daily, monthly and yearly reports available.
Improved Backup and Restore Capability Backup and restore capability now extended to include black/white lists (user, domain, system and session) and custom messages in addition to the system configuration.
Mail Storage Performance Improvements
Tiered Admin when in Server Mode
Increased Number of Admin domains
Override server can be specified for FortiGuard updates and queries.
Logging enhancements Received IP and name/date stamping and file type details added to log message format. In addition log messages have been extended to avoid truncation of information.
SNMP Monitoring HA Monitor variable introduced – requires an updated MIB file.

Mail Handling Enhancements:

Enhanced Access Control Rules Provides the ability to limit access based on sender/recipient email or IP address.
Enhanced Address Mapping at domain / sub-domain level
Multiple IP selection for outgoing email
Deferred Queue Management Controls
Support for intermediate CA Certificate handling
Option to disable ESMTP support
Secondary LDAP Server support
LDAP cache handling performance enhancements

AntiSpam Enhancements:

Sender Policy Framework (SPF), DomainKeys, DomainKeys Identified Mail (DKIM)
Centralised Quarantine
Central Administration of User Preferences
Domain Level Black and White lists
Quarantine Search Capability
Allow domain level timing for release message
Content level white listing, for message body or subject line.
Support for local FortiManager database query

WEBMAIL Enhancements:

Quarantine Alias
Multi-Language Support, default language, customized languages
Folder Support
User level option to disable SPAM report

MR6 brings IPv6 Support to FortiGate Web UI

noreply@blogger.com (blogger) — Wed, 06 Feb 2008 17:16:00 +0000

While not mentioned in the release notes MR6 provides support for IPv6 configuration in the WebUI. In order to start using it you have to enable "IPv6 Support on GUI" in System > Admin > Settings.

Please note that you can also change port number for SSL VPN portal in Web UI.

After you enabled IPv6 support in Web UI you can see IPv6 in address & policy configuration:

You can also see IPv6 routing table in Router > Monitor.

FortiGate FortiOS 3.0 MR6 Build 660 is out

noreply@blogger.com (blogger) — Wed, 06 Feb 2008 08:09:00 +0000

This morning Fortinet made available a new Maintenance Release 6 version of FortiOS 3.0. Only brief list of enhancements is currently available, we will review them in more details shortly:

Support Multiple Antivirus Databases
Advanced Load Balance Features
User Interface Enhancement
MIB Extensions for RTM
Profile Based IPS Sensors
Authentication Adjustment
Read-only super_admin
TACACS+ Support
Authentication-Based Routing
VDOM GUI Enhancement
Control MSN over HTTP Proxy
FSAE Enhancements
SSL Tunnel Extension
Antivirus File Typing
VDOM Admin Authentication via RADIUS
Modem AT Commands via CLI
AMC Disk Extension
PING Server for HA Failover
Soft Switch Interface Mode

In addition FortiAnalyzer software 3.0 MR6 was posted on support FTP, but no information regarding new features available at the moment.

FortiMail Updates Provide Better Spam Filtering And Easier Administration

noreply@blogger.com (blogger) — Thu, 10 Jan 2008 15:20:00 +0000

After initial release of FortiMail 3.0 Fortinet recently provided 2 updates (Maintenance Release 1 & 2), which not only fixes some of the bugs, but also provides new spam filtering technologies and easier configuration options.

FortiMail 3.0 Maintenance Release 1 provides the following spam scanning enhancements:

PDF Scanning that combines heuristic rules and image recognition technology
Deep Header Scanning checks all message transmission path by examining e-mail "Received" headers
Dynamic Heuristic Rules: instead of statically configured rules in previous versions MR1 uses FortiGuard infrastructure to deliver rules updates on the fly for better handling of new spam variants

FortiMail 3.0 Maintenance Release 2 is mainly focused on UI improvement. While ISP and MSSP users like highly customizable approach of FortiMail configuration many corporate users complained about configuration difficulties when only one domain with one security policy was needed. In order to help such customer MR2 introduces new management modes and wizards:

Quick Start Wizard is added that provides streamlined step-by-step configuration for single e-mail domain environments
2 Management modes introduced: basic and advanced. Advanced mode is the same as previously available while basic mode is ideal for easier installation when only subset of full FortiMail functionality is needed.
2 Predefined Reports are added for statistics on previous day and last week
High Availability settings are enhanced with HA Recovery mode setting

FortiMail 3.0 Maintenance Release 2 (MR2 Build 199) is available for download from support site.

FortiMail 3.0 Avaialble for Download

noreply@blogger.com (blogger) — Thu, 09 Aug 2007 20:37:00 +0000

FortiMail version 3.0 (announced few days ago) is available for download from support FTP. You can also try a Web-based demo if you know a secret password.

Fortinet announces FortiMail Version 3.0

noreply@blogger.com (blogger) — Mon, 06 Aug 2007 07:37:00 +0000

On August 3rd Fortinet posted documentation and release noted for the new version of FortiMail - long awaited 3.0. These version is not available for download yet, but based on release notes it looks like this version should be 2.9, not a 3.0 as there are no major improvements in this versions.

It looks like Fortinet would like to have all products to be branded as version 3.x and this is the only reason to switch from 2.x to 3.x

According to documents released FortiMail 3.0 have the following new functionality:

Upgraded kernel to address software RAID issues on the FortiMail-400
A global Bayesian database
Multiple antispam actions per antispam profile
System quarantine support for outgoing email
Bayesian scan support for outgoing email
GUI access for the system quarantine administration user
Email alias enhancements to allow an alias list to contain itself as a member
Aggressive image scanning
RBL renamed to DNSBL
Domain configuration enhancements to allow the local domain to be the same as the mail server's domain
DDNS enhancements
Relay server SMTP authentication support
GUI enhancements to allow accessing a profile directly from the policy page
Support for a second syslog server
Support for AV updates through an HTTPS proxy
Greylisting improvements to make the initial expiry period configurable, increase the supported greylist database entries on high end units and bypass greylisting for an authorized client
An option to reset custom messages to defaults
Support to customize the spam report subject line and the Webmail login banner
A re-ordering of the black/whitelist processing order
Dictionary and banned word logging improvements to add the word that triggered the filter to the log message
Portuguese language support added for Webmail

FortiOS 3.0 MR5 for FG-50A & FG-60 (Release Candidate)

noreply@blogger.com (blogger) — Sat, 28 Jul 2007 12:36:00 +0000

During last few weeks most of FG-50A and FG-60 owners were filling stressed and unhappy. There were even some rumors that Fortinet will not support current users of low-end models and they will be forced to upgrade to FG-50B or FG-60B. The reason for this was absence of new build for low-end FortiGate's, MR4 & MR5 were released without FortiGate-50A/60 builds.

Finally Fortinet revealed a release candidate of memory-optimized build of MR5 for low-end models:

FortiGate-50A
FortiGate-60/60M/60ADSL
FortiWiFi-60/60A/60AM

Build is available for download from Support FTP. Please note that this build is still a Release Candidate 4/Beta build and it is not recommended for production systems. Build number is 0559.

We already downloaded and installed this build to one of our test boxes. Memory usage is slightly higher that with Memory-Optimized build of MR3 (66% against 57% in our configuration with several VDOM's), but it is still OK for most of SMB/SOHO applications.

For those who are still on MR3 these build brings features of both MR4 and MR5:

New Dashboard with customizable layout
Enhanced VDOM's: changed configuration and per-VDOM Protection Profiles
Authentication now can be tuned per protocol and performed per single policy
Packets/Bytes counters per policy
PKI Authentication Enhancements
Better VoIP support with SIP, SIMPLE and SCCP (Cisco Skinny)
FortiGuard Management&Analysis Service Support
Interface Aliases
Support of any USB Flash Disk (Only FortiUSB branded disks were supported before)
Many Routing Enhancements for NAT, Multicast, OSPF and BGP
IPv6 IPSec support
and many more!

FortiGate-60B Full Specification - Compared to FG-60

noreply@blogger.com (blogger) — Wed, 25 Jul 2007 06:13:00 +0000

There are no FG-60B specifications and data sheets on the official Fortinet site, but we see more and more information coming on distributors' sites.

Here is the full comparison of new FortiGate-60B to older FortiGate-60:

Parameter	FortiGate-60B	FortiGate-60
LAN Switch Interfaces	6	4
WAN Interfaces	2	2
DMZ Interfaces	1	1
Analog Modem	Yes	On FG-60M
WiFi Interface	On FW-60B	On FW-60
Built-in ADSL Modem	No	On FG-60ADSL
USB Ports	2	2
PC Card Slot	Yes	No
RAM	256MB	128MB

Firewall Performance	100Mbps	70Mbps
3DES VPN Performance	64Mbps	20Mbps
Antivirus Throughput	20Mbps	15Mbps
Maximum Session	70,000	50,000
New Sessions/Second	3,000	2,000
VPN Tunnels	50	50
Dimensions (HxWxL)	1.75x10.87x6.13in	1.38x8.63x6.13in
Weight	5.5 lbs (2.5 kg)	1.5 lbs (0.68 kg)

As you can see FortiGate-60B adds more power, but you should note that it is bigger and heavier (the same size as FortiGate-100).

FortiAnalyzer now supports ext3 File System

noreply@blogger.com (blogger) — Mon, 23 Jul 2007 07:59:00 +0000

Starting from version 3.0 MR3 FortiAnalyzer supports ext3 file system in addition to Resier file system used before. EXT3FS provides much better stability and it is recommended to upgrade FS used on all FortiAnalyzer units. To do this you need to reformat disks or change RAID level which will cause all information to be erased.

Please check the Release Notes document before formatting disks as you will need to restore RVS Engine & Plugins afterwards. Also doing a backup before formatting disks is highly recommended.

Starting from MR4 you can also speed-up the FortiAnalyzer by indexing ext3 file system: this is done by "diagnose sys filesystem fsfix" CLI command. Please note that this command execution will reboot FortiAnalyzer and might take time.

FortiGate-60B Adds More Power and 3G HSDPA/EV-DO Connectivity

noreply@blogger.com (blogger) — Wed, 18 Jul 2007 06:13:00 +0000

After Fortinet officially announced FortiGate-50B and FortiWiFi-50B most of the people were waiting for FG-60 replacement. It is not on the Fortinet's Web-Site yet, but some sites are already showing information regarding upcoming FortiGate-60B and FortiWiFi-60B.

According to non-confirmed information FortiGate-60B provides following advantages over older FG-60:

More Ports: 6-port switch on Internal interface instead of 4. Also 2xWAN and DMZ ports as on FG-60.
More Power: Significantly increased CPU/ASIC power: FW Performance 100Mbps, 3DES VPN Performance 64Mbps, AV Performance 20Mbps.
More Memory: FG-60B have 256MB RAM, you can forget about 80% memory usage right after start-up.
More Connectivity: FG-60B comes with built-in analog modem (previously available only on separate model FG-60M) and PCMCIA open slot for 3G UMTS/HSDPA/EV-DO card (card is not included). There is no detailed information available on cards/operators supported. FortiWiFi-60B comes with 802.11 a/b/g Access Point built-in.

To summarize: Fortinet delivers a new SOHO/Branch Office device that brings together all UTM Functionality (Firewall, IPSec & SSL VPN, IDS/IDP, Anti-Virus, Anti-Spam) plus gives you 2 WAN connections for regular Internet connections, analog and/or 3G backup connection and WiFi.

FortiGate-60B have the same size and looks as older FortiGate-60.

On 17.07.2007 Fortinet posted an official FortiOS 3.0 MR5 Build 559 for FortiGate-60B and FortiWiFi-60B on their support site.

Using FortiClient? Upgrade to 3.0 MR5 now!

noreply@blogger.com (blogger) — Thu, 12 Jul 2007 16:23:00 +0000

FortiClient 3.0 MR5 finally supports differental updates - it downloads only differences since lsat version. That means that you do not have to download 20MB+ definitions file every day. Delat fies are about 50KB in size.

Also because of this you can enable hourly AV update - this is quite important as new worms are spreading rapidly now and daily updates can leave you unprotected!

In addition you will get few additional nice features:

Better AV scanning performance
Automatic scanning of new removable media
Critical FortiClient patches will be downloaded and installed automatically
Per-user Web Filtering profiles
Startup list monitoring on 64-bit Windows
Config lock-down with a password
No need to reboot after first installation (you will still have to reboot after upgrading from previous version)
Windows Server 2008 Beta and Citrix supported

Why wait? Go and upgrade now!

Windows Media Player on Checkpoint UTM-1

noreply@blogger.com (blogger) — Tue, 27 Mar 2007 08:45:00 +0000

This post is not about FortiGate, but about Fortinet competitor - Checkpoint. Newly released UTM-1 appliance can be used not only as a Firewall, but you can also watch video on it. Look how simple is that.

Don't try it with your FortiGate ;)

Memory Optimised Build for FortiGate-50A/60

noreply@blogger.com (blogger) — Mon, 26 Mar 2007 15:00:00 +0000

Finally Fortinet released a memory optimised version of FortiOS 3.0 MR3 for low-end devices (FortiGate-50A, FortiGate-60/60M/60ADSL and FortiWiFi-60/60A/60AM). This build is based om FortiOS 3.0 MR3 Patch 7 (Build 0410).

According to number of people who already deployed this build memory usage drops significantly: from ~80% to ~60%.

Memory Optimised Build 410 is available for download from Tech Support FTP.

Few additional features in FortiOS 3.0 MR Release Candidate

noreply@blogger.com (blogger) — Mon, 04 Sep 2006 15:43:00 +0000

There are few additional features that I just discovered in addition to those described in a previous post.

Port for Telnet and SSH can be changed via WebUI. In addition you can enable SCP for secure file transfer
Addresses can be bound to specific interface
When configuring Operation Mode (NAT/Transparent) you can click a check box to use Asymmetric routing
You can group several VIPs with "VIP Group" option
Multicast configuration tab added to Dynamic Routing configuration

FortiGate FortiOS 3.0 MR3 RC1 Build 388 (Maintenance Release 3, Release Candidate 1) is out

noreply@blogger.com (blogger) — Sun, 03 Sep 2006 08:47:00 +0000

Fortinet just published a FortiGate FortiOS 3.0 MR3 RC1 Build 388 (Maintenance Release 3, Release Candidate 1) on the support FTP.

Please be aware that this is an interim build: do not use it in a production environment unless technical support asks you to do it in order to resolve some specific issues.

What's new in this build:

Nice menu opening animation ;)
You can add "section headers" into your policy table in order to separate some blocks of policy - i.e policies for particular customer, policies for specific server, etc. Also you can select which colums to display and filter policies by any field.
You can easily specify multiple addresses or services in a policy without creating a group - to do it simply click "Multiple" button next to the appropriate combo box.
URL filtering now works not only for HTTP, but also for encrypted HTTPS
AntiVirus scanning now works for NNTP (Network News Transfer Protocol)
Most of the lists supports creation of several separate lists and then attaching different lists to different policies (in previous builds of FortiOS 3.0 it was supported only starting from FortiGate-800 model, now it is possible on all models): File Pattern Block List, URL Block Lists (Web content Block, Web Content Exempt, URL Filter) , Anti-Spam Block Lists (Banned Words, IP Address Black/White List, E-mail Address Black/White List)
Status Dashboard slightly reworked: small CLI Console added directly to a dashboard, you can expand it to a full window and edit colors by clicking small icons in top right corner; also number of administrators logged in is now shown in a "System Information" section, not on a bottom bar.
SSL VPN now supports VNC and RDC remote terminals via built-in Java client

Fortinet changes Release Management Process: Release Candidates are available now!

noreply@blogger.com (blogger) — Sun, 03 Sep 2006 08:34:00 +0000

Starting from now Fortinet makes available "Candidate Release" builds of FortiOS software via support FTP site. If you are running Candidate Release you will immediately notice big "Candidate Release" banner on top of WebUI.

Warning: please be careful before installing Candidate releases in a production environment, these builds are targeted to a lab environment. Please read "Who should use these build" section below before installing it!

What is a Candidate Release?

A part of Fortinet's Release Management Process is to make available builds of product firmware (FortiOS, FortiAnalyzer, FortiManager, etc.) specifically for evaluation and feedback. Obtaining comments on how the firmware functions in a variety of environments is crucial to improving the quality. To that end, Fortinet releases preliminary builds, called "Candidate Releases", to its customers (external and internal) for the purpose of gaining insight on the quaility of the firmware. This is done at various stages of the maintenance release test cycle. Starting with FortiOS v3.00 MR3, the Release Management Process has included adding a label at the top of the Web UI - "MRx Candidate y" - PD builds will have the label removed. B0388 has been qualified to the point where QA has approved it for release as CR and thus the label reads "MR3 Candidate 1".

Who should use these builds?

Fortinet encourages customers who need a certain bug fix or wish to test the latest software to load the build, verify its functionality, and provide us with feedback. However, Fortinet does not guarantee uninterrupted or error-free operation of the firmware therefore, if your network is considered mission-critical and can not tolerate any risk, then MR3 Candidate1 is not recommended. You should wait for the official release of the firmware.

FortiAnalyzer 3.0 MR2 (Maintenance Release 2) Build Changed

noreply@blogger.com (blogger) — Wed, 30 Aug 2006 09:06:00 +0000

Please be aware that on August 29th Fortinet silently updated FortiAnalyzer 3.0 MR2 code. Build 364 is removed from support FTP and Build 365 placed instead.

It is strongly recommended to check which build you are running and if you have a Build 364 on your machine update it to a newer Build 365, which is now an official MR2 Build.

There is no exact information about Build change, probably some minor fixes.

FortiGate FortiOS 3.0 MR2 Build 318 (Maintenance Release 2) is out

noreply@blogger.com (blogger) — Wed, 16 Aug 2006 16:23:00 +0000

Fortinet just released Maintenance Release 2 version of FortiOS 3.0 for all FortiGate devices. In addition to numerous bugs fixed it provides some new functionality:

Drag-and-drop policy reordering: While editing policies in Firewall->Policy you can simply grab a policy with a mouse and move it to a new location with a mouse. Simple and looks nice!
Drag-and-drop works also in Web Filter URL list
Columns button in a top right corner of policy list can be used to add/hide additional columns. For example you can add Protection Profile column and easily see Protection Profiles assigned to each policy
Authentication Keep-alive page is now being used after FortiGate authenticated the user to keep a session from timing out
Run only configuration allows you to edit configuration without saving it to the flash. This is extremely useful when experimenting with a remote box: if you will loose the box due to erroneous configuration just ask someone to recycle power and box will boot up with old config. Don't forget to return to standard mode once you finished configuring the box.
DHCP Renew and PPPoE Reconnect slightly reworked
Static ARP entries: when working in NAT mode you can staticly bind ARP entries via CLI
FortiGuard status indicators redesigned for better representation of service availability
Changing default ports for TELNET and SSH: finally you can change ports for TELNET and SSH servers, this can be done via CLI only
Loopback Interface: you can use virtual Loopback interfaces for easier dynamic routing configuration or as a source for IPSec tunnel
Uninterpretable firmware upgrade in HA mode: cluster member upgrades themselves one by one without interrupting traffic!
Equal Cost Multi-Path Routes can be used to load-balance traffic between multiple interfaces on a per-session level
Enhanced H.323 support
Multiple IP Pools in firewall policy can be configured via CLI for noncontagious pools support
Log&Report part redesigned
When using FQDN based policies FortiGate actively queries DNS servers instead of monitoring passing DNS traffic

More information provided in Release Notes document

Inbound Traffic Shaping per Interface

noreply@blogger.com (blogger) — Thu, 03 Aug 2006 16:17:00 +0000

Traffic shaping prior to FortiOS v3.00 was performed on a per firewall policy basis. Starting from FortiOS 3.0 MR1 FortiGate supports limiting the amount of inbound traffic on an interface.

The CLI command to enable inbound traffic is:

conf sys int

edit port1
set inbandwidth 99

end

An inbandwidth value of zero (kilobytes per second) means unlimited - no inbound traffic shaping configured.

FortiClient 3.0 updated to MR1

noreply@blogger.com (blogger) — Tue, 01 Aug 2006 16:43:00 +0000

Fortinet recently released new build of FortiClient version 3.0. It is available for download now.