FortiOS v5.x Alert email settings for email servers in different subnet

If your fortinet device and email server are in different subnet, FortiOS v5.x will not be able to send alert emails to email server by setting only email server address from Gui.

You should also perform some configuration from CLI.

Connect to device by SSH.

FG100D # config system email-server
 

FG100D (email-server) #
set      Modify value.
unset    Set to default value.
get      Get dynamic and system information.
show     Show configuration.
abort    End and discard last config.
end      End and save last config.


//execute show command to view your current settings.

FG100D (email-server) # show
config system email-server
    set reply-to "fw@fxxxx.com"
    set server "10.1.10.11"
    set port 587
end

 //execute get command to view your current settings.

FG100D (email-server) # get
type                : custom
reply-to            : fw@fxxx.com
server              : 10.1.10.11
port                : 587
source-ip           : 0.0.0.0      //define source-ip in order to FG to access email server in different subnet
source-ip6          : ::
authenticate        : disable
security            : none


FG100D (email-server) # set source-ip 10.5.x.x (FW interface IP address that can reach messaging server)


Now, FG will be able send alert emails to messaging server in different subnet

Be sure you already configured relay on your messaging server.
Read more...

Enable Host Check (AV- FW) FortiOS v5

config vpn ssl web portal

edit full-access

set host-check av-fw

end

Read more...

Enable two factor Email authentication FortiOS v5

To enable email two-factor authentication - CLI

config user local

edit  username

set email-to  useremailaddress

set two-factor email

end

Read more...

How to Enable IPv6 on Juniper ScreenOS devices.

Use the command below;

set envar ipv6=yes

After executing command you should reset the device.

After reloading of device has been completed,

You can check ipv6 support by using "get envar" command.
Read more...

Juniper SSG Prevent Brute Force and Dictionary Attack

Open Management Console

Under Configuration --> Admin --> Management

Configure the "Max Login Attempts" value.
Read more...

Symantec Agent is not running or running an incompatible version

If you are living DHCP address switching problem between Quarantine and Default scope address and using DHCP pluggin for NAC solution check the following steps below;

1) Firstly Control your DHCP User Class Properties ; Be sure you have correctly configured your scope options.





Under Static Route Option you should type the releaated host ip address twice or if host is one other subnet type gateway and host ip address.

2) Under User Class Check if your DHCP lease time is not too long.





http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007378141105298

3) Check the solution in the links below;
http://www.symantec.com/connect/forums/snac-dhcpplugin-always-get-quarantined-ip-address

http://service1.symantec.com/SUPPORT/ent-security.nsf/ppfdocs/2008020608273348?Open&dtype=corp&src=&seg=&om=1&om_out=prod

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007091212133148


4) Lastly , as my experience DHCP Server and SEPM should be installed on different servers.

Read more...

Block or Allow Google Earth Through Firewall

In order to deny or allow access to Google Earth , block or allow access to these address on your firewall;

http://maps.google.com/
http://auth.keyhole.com/
http://kh.google.com/
Read more...

Block Skype using Group Policy

   Copy the following below  code to the text file and save as Skype.adm then import to your Domain Group Policy.

Code

 Then use various options to limit Skype usage.

  

Read more...

Create Custom Services in Juniper Firewall

Open Custom Services from Menu;





Click New button.



Type the new service name , Choose transport protocol .

Enter 0 and 65535 for source port and enter the port number of program to Destination port part.



Click OK . Your New Service is ready for NAT.
Read more...

Netscreen PPTP NAT Configuration

Synopsis

Allow PPTP traffic inbound through a NetScreen in NAT mode with only 1 publicly available IP address. This method can be applied to the general issue of port forwarding by substituting the protocols (e.g. pptp to http)
Problem
Environment:
· VIP same as untrust
· Only have 1 publicly available IP address
· VIP defined with PPTP service
Symptoms & Errors:
· Cannot define VIP same as untrust if using PPTP as service



Solution
To address this problem, enable the VIP multi-port command, which will allow configuration of a VIP service which has more than 1 port it listens to. Previously, a VIP service can only listen to one port. This feature is only available on ScreenOS 3.0.1 or higher.

From the command line interface (CLI):

set vip multi-port [Enter]
save [Enter]
reset [Enter]

The multi-port command will match the first port it sees in the custom service.
Next, define a custom service for PPTP. From the CLI:
set service CustomPPTP group "other" 47 src 2048-2048 dst 2048-2048 [Enter]
set service CustomPPTP + tcp src 0-65535 dst 1723-1723 [Enter]
set interface untrust vip 2048 CustomPPTP 10.1.1.10 [Enter]
set policy incoming "Outside Any" VIP::1 CustomPPTP Permit [Enter]

In this example, the PPTP server was assumed to be on the trust side of the NetScreen, at IP address 10.1.1.10


Read more...