FortiGate Scripts I’ve been doing quite a bit of scripting for FortiGates recently. Much of it in TCL. FortiManager is capapble of running TCL scripts, which allow for the script to make decisions. For example, I have a script that will check the name of the FortiGate it is running on, then based on the hostname, it will assign different values to the device. I needed to write this script so I could roll out ADVPN to multiple sites, for a client.

Home Lab Build This seems like good time to dust off the home lab gear. So I’ve pulled the hardware out and made sure everything has downloaded all the updates. My lab is pretty simple. The network is a FortiGate, FortiSwitch and FortiAP. The compute and storage is a desktop that I’ve jammed as many SSDs into as I can. I’m running Hyper-V on Windows 10, because it is simple and provides the features I need.

In the Before Time Before everybody had to stay home all the time, I would be at the local gym 3 days a week working out with barbells. I would squat, either bench or overhead press, deadlift and then do chin ups. Simple, effective, full body and as heavy as I could make it. My goal for 2020 was to deadlift 555 pounds for a set of 5 reps. I was deadlifting 380 pounds for 5 reps before the gym closed, so I am not likely to hit my goal this year. This is fine - things happen. 555 pounds was a stretch to begin with. I had calculated in early January that I needed to add about 4 pounds to my deadlift a week for 40 weeks to hit this goal. But I re-aggivated a shoulder injury and that set me back a bit in February. So with the gym closed - and not having a home gym - I’ve got to come up with something else.

Purpose How do you design a well-organized, well managed network for small/medium business? Let’s layout some assumptions: There are server in the office The servers are in either in a well-organized closet or in a server room (they are not in a Colo - but access is restricted) There may be some amount of Cloud/SaaS applications This is not a VDI environment (we could sketch that out in a different post) Security is a concern - but not security at any cost Let’s start with what I generally see As a consultant, I’ve been engaged by dozens of small/medium size businesses and many large businesses. What I tend to see in the small/medium group is a flat network using a single subnet - a /24 or less common a /16. There is only one VLAN and all the Servers, Switches, Hypervisors and Desktops are in the broadcast domain. If I was an attacker, this would be a “Target Rich Environment”…

Components As detailed in my post on Cryptographic Cipher Suites each of the suites has a Protocol, a Key Exchange algorithm, a Signature Authentication algorithm, an Encryption algorithm, and a Message Authentication algorithm. Here we are going to compare these different components and highlight the cipher suites currently considered strong*. * currently only means at the time of this writting - a flaw could be found in the algorithm or in the implementation of the algorithm at any time, so do additional research to confirm the current strength of the cipher suite. You’ve been warned…