Introduction to FortiGuard

FortiGuard is important for all services that require updates. The FortiGuard Team consists of a large number of Security Analysts distributed in several countries that are dedicated to analyzing various areas necessary for complete security protection. These areas include Antivirus (AV), Web Content Filtering (WCF), Intrusion Prevention (IPS), AntiSpam, Application Security, Application Control, Vulnerability Control and Management (VCM), and Web Security. These researchers use automated tools to add updates to FortiGuard, so they only see action when something really new and complex is at hand, which happens more often than you would think.

This human FortiGuard team is focused on discovering ways to improve Fortinet’s Inspection Engines. These engines are proprietary to Fortinet, which defines the roadmap and controls the future of the technology. When problems occur; the developers may assist with diagnosing, troubleshooting, and creating a fix. Finally, since the technology was developed in-house, Fortinet does not have to pay any royalties, keeping the price low. These same advantages apply to the creation of the signatures (Inspection Rules) that feed to the devices installed around the world.

The Fortinet Distribution Network (FDN) is how Fortinet effectively distributes content to all devices across the world. You can think of the FDN as a “repository in the cloud” for both Inspection Engines and Signatures. When Fortinet Devices (such as FortiGates, FortiWeb, or FortiCarrier) are configured for dynamic security inspection, they constantly query the FDN to determine which server is closest. Once determined, this server is queried for security updates which, once found, are downloaded and applied. However, this only occurs if the device is entitled. In other words, this occurs when the serial number is linked to a license contract which references the service that has been updated. If you wish to know the servers that feed your device, you may run the CLI command “diagnose debug rating.”

Each mechanism (Antivirus, Web Content Filter, etc.) works differently, so the FortiGuard technology and processes differ from mechanism to mechanism, as explained later in this chapter. However, you must understand the general architecture:

FortiGuard Licensing

It can be challenging to hire a group of smart people capable of doing detailed security research and to maintain the infrastructure capable of distributing updates all over the world in a very short period of time. This is why most security firms charge for updates. Of course, Fortinet is no exception. FortiGate devices access these resources through appropriate licensing.

Fortinet offers licensing for updates on these features: Antivirus, IPS, AntiSpam, Web Content Filter, and Vulnerability Management. While many firms license such technologies in terms of total users, concurrent users, mailboxes, IP counts, or sessions, Fortinet simplifies the process and simply licenses according to the performance of the device. Basically, the bigger a box you have, the more you pay to keep it up-to-date.

Fortinet offers two options to license updates for the security services: As a Bundle and Individually (A la carte). Let’s review each one.

Configuring FortiGuard on the FortiGate

Doing UTM Analysis: Concepts

Troubleshooting the FortiGuard Distribution Network (FDN) Connectivity

Introduction

Several years ago, when the Internet began, applications were better behaved. To begin with, there were no such things as “network-based applications”. All applications ran on the local systems, and the Internet was used only as platform network, not as a platform. Back then, applications used well-defined ports, and you could establish a direct relationship for a network protocol (like POP3), to a port (TCP/110), to a program (Eudora or Microsoft Mail).

However, as the Web grew more popular, it was used to serve not only information but also taking feedback, information, and even code from users. Developers began changing first to a hybrid model where code ran both in the browser and on servers and then moved the servers to “the cloud”. Cloud computing forced a change to the security paradigm. No longer could we rely on each protocol mapping to a single purpose. Now we had a single protocol (HTTP) being used for many purposes such as E-mail, Word Processing, File Transfer, Games, and, of course, malicious software. This paradigm change required network inspection to become smarter, so it could identify applications.

The Need of Application Control

Application control is in high demand for a number of reasons, but the two most important ones are (1) most traffic uses the port TCP/80 to exit the organization’s network, and (2) we need more control over the information flowing through the network. Thus, we need the ability to detect, classify, and enforce a security policy for a given application, regardless of the method used to connect and transmit over the network.

Deciding when to use Application Control

Application Control is more often used for Outbound than for Inbound traffic. This is, you would normally need Application Control for connections being generated from your users to the Internet.

You would normally NOT need Application Control if:

You might need Application Control if:

You might also want to review the policies and regulations that affect you and your organization. Regulations are often why organizations enable Application Control on their FortiGates.

Before you Configure Application Control (Sizing and Design steps)

Application Control imposes load in the FortiGate. In general, since Application Control shares some internal mechanisms with IPS including the Inspection Engine, it would be fair to say that Application Control imposes around the same load that IPS would on the system. However, as it is a Flow-based inspection technology, the load is lighter than similar proxy-based technologies. Also, it does not use the Proxy Connection Table, so it does not add to the risk of running out of proxy connections.

You should use a Network Diagram to identify where the users are and how they are expected to generate HTTP traffic. This way, you can identify which flows carry traffic that would require deeper analysis than just source/destination. Pay special attention to the traffic that have little or no restriction on the destination addresses or ports, since the lack of restrictions can be used by potentially risky applications to transfer data. These are the traffic flows that should have Application Control applied to them. In general, be specific on what you are trying to achieve. For example: do you wish to reduce liability due to internal users running malicious applications or are you more interested in carving out the majority of your bandwidth for business-critical purposes? Having a statement on what you are trying to achieve will greatly help you create a configuration that will match that statement.

How Application Control works

Applications are constantly evolving, and in order to be effective, FortiGuard Analysts are constantly updating the list of supported Applications. We must remember that the only way the FortiGate can identify an Application is by analyzing the traffic it sees, correlating source and destination ports and IPs, as well as traffic patterns. However, the behavior can change over time as the developers creating these applications add features in real time. This is why it is important to keep the Application Control signature database up-to-date.

Remember that Fortinet keeps Encyclopedias online at http://www.fortiguard.com. By browsing to “Application Control Service” and then to “Application Control Encyclopedia”, you can access detailed information about the applications recognized by the FortiGate. The same portal contains an Application Submission form that allows you to submit information to the FortiGuard analysts about an application that needs to be updated or added to the system. The submission form will return a ticket number via e-mail and Analysts will consider adding support for (or enhancing) the application mentioned. You don’t need to own a FortiGate to submit, but existing customers will receive higher priority.

Just as with IPS, every modern FortiGate has an initial Application Control signature database. Since this database is stored locally, it is possible to start analyzing traffic at any time. This is good because it allows the immediate detection of known applications. However, once again it is important to remember that the efficiency and accuracy of detecting applications will largely depend on how up-to-date the database is. Due to this, you should first update the IPS database with the “exec update-ips” command, which includes the Application Control signatures.

Configuring Application Control

The Need of Network Antivirus

Traditionally, Antivirus technology has existed on the endpoint, the specific workstations, and servers where malware tends to run. However, as threats grew more complex, so did their protections. Thus, in addition to existing on the endpoint, Antivirus also moved to the perimeter.

Fortinet’s technology provides protection against many types of malicious software. Being a network device, the FortiGate is better positioned than endpoint protection to detect malicious network traffic, such as the communication channels that malware authors use to control the systems they infect. However, to properly protect against blended threats, nothing beats the combination of an edge technology like FortiGate combined with an endpoint Antivirus solution.

Basically, you don’t want the Antivirus running on your system to be your last line of defense. This is especially true of reactive mechanisms, since the threat must first be detected before the protection be developed. Also, there are advanced threats that look for Antivirus software running locally on endpoints, and then shut them down or temporarily disable them to avoid detection. So, supplementing the endpoint protection systems with a network focused system makes a lot of sense. Not only do you have two potential catch points, but by filtering out malicious software before it reaches the endpoint, you are requiring less work of the endpoint, thereby saving resources for other uses.

Fortinet manages to save even more resources by implementing an offloading mechanism called the Content Pattern Recognition Language (CPRL) in the Content Processor (CP) ASIC. This chip is included in every FortiGate and has the ability to tie into the Antivirus and IPS functions, speeding them up drastically.

Deciding when Network Antivirus is a Good Idea

There are two network regions where you may wish to place network Antivirus: between a server and the rest of the network or between your users and the rest of the network.

For Servers, your goal would be to protect both the server itself and the data stored on the server. For example, if you have an FTP server, you may wish to protect against attacks that compromise the server itself so it can then spread to other users that access FTP. This was a very common attack in the late 2000s and took over many webhosting companies. You may also want to protect email servers so your users, internally and externally, are not infected by malware that is delivered to their INBOX. Finally, you may wish to protect outbound traffic from web servers. Web servers are increasingly targeted by attackers and used to host multi-stage downloader malware.

Basically, it is wise to place Antivirus to look at bidirectional traffic to all servers on both IPv4 and IPv6 networks. When implementing Antivirus in this manner, be sure to check your firewall policies and make sure that each path to your servers has protection on it. It is common for FortiGate administrators to forget to protect a failover path or emergency access VPN. Any path without protection is a potential point of compromise.

When protecting users, it is important to remember that inspection is based on traffic flow. For example, when a user downloads a file, they initiate the connection to the file server, and the file is then downloaded across the established connection. Thus, even though the file is coming “in” to the network, it will be inspected based on the rules for traffic going “out”, as that is the direction in which the session was established.

Secondly, bear in mind that, while the FortiGate is very efficient at scanning this traffic, it does take resources. If you have users communicating with systems that you know to be safe (text files coming from an FTP server, for example), you can turn off inspection on those pathways and reduce total load on the system. Note, however, that in some highly sensitive or regulated environments, you have to inspect all traffic regardless of expected content. In these situations, you may want to get a FortiGate one size larger than you would otherwise need, just to reduce the risk of load issues.

Before you Configure Network Antivirus (Sizing and Design steps)

Due to the amount of resources required to support it, Antivirus is often the most expensive feature on the FortiGate. Even though it is accelerated, not all of the processing is offloaded, so both CPU and RAM can be consumed quickly. This is especially true if you are using Antivirus in a Proxy-Based mode. Thus, you should be careful with WHAT you choose to scan.

Once you have defined the WHAT, you must determine the HOW:

Zoo viruses are viruses that have not been active for more than a year.

As you can imagine, choosing “Extreme” will greatly reduce performance. This is a tradeoff and, in the interests of speed, many people choose to run as “Normal” or “Extended” and trust their endpoint AntiMalware system to catch older and custom malware. However, it is only a good idea to do this if you have an extremely trustworthy AntiMalware system running on the endpoints.

How Network Antivirus works in the FortiGate

Remember that FortiGates download updates from the FortiGuard team, so they reside locally. Thus, the more comprehensive your selected database, the more space it will take up on your device. You can choose the three databases defined in the previous section or “flow-based”. You can also configure grayware protection which scans for attacks like adware, keyloggers, and spyware.

You should also give consideration to how the system will behave when resources are low. FortiGates automatically enable a protection mechanism called “conserve mode” when memory begins to run low. This is basically a series of memory recovery measures that include blocking new connections to avoid over-subscribing the system. Once there is enough RAM available, this mode is deactivated. If you choose to prioritize the system for Antivirus, you might want to define a fail-open state, so if the device becomes overloaded, Antivirus scanning ceases so memory can be recovered. However, be careful doing this, as it opens you up to a scenario whereby an attacker can launch a denial of service attack on your device to get their malware past your defenses. When using the “set av-failopen” mode, your options are “pass”, so traffic is passed with no inspection until memory becomes available, “idledrop”, which forces closure of unused connections, “off”, which stops accepting new connections, or “one-shot” which turns off scanning completely.

In addition to running out of RAM, you can also run out of proxy session table entries. This behavior is defined by the “set av-failopen-session” command. The parameters match those of “av-failopen” described above.

In addition to global options, there are also protocol-specific options. While these do apply to the way the UTM as a whole handles a protocol, they are technically not “global”, because they do not apply to all protocols. Each protocol definition can affect one of: http, ftp, imap, pop3, smtp, nntp, and im. If you are running a FortiGate with SSL inspection capabilities, you can also define options for https, ftps, imaps, pop3s, and smtps. Each protocol also has its own specific options. In the HTTP example below, options include “clientcomfort”, which avoids timeouts by sending the client packets every few seconds (as defined by the interval and bytecount), “no-content-summary”, which masks the files from appearing in the GUI dashboard, and “oversize”, which blocks files that exceed the size specified in the limit (in Mb). In the FTP example, the “splice” options keep a copy of the downloaded file as it streams it to the user. This way, if malware is found in the file, the connection can be aborted.

Once the protocol options are determined, you can assign the profile to a firewall policy. In the example, you’ll see that FTP-based malware is set to be quarantined on the FortiGate if found. This means that the administrator must be diligent at checking the quarantine and dealing with what is found. In contrast, HTTP-based scanning is set to drop any compressed files that have a password assigned. Since such files are encrypted and cannot be scanned, this is the safest approach.

Finally, you must add an Antivirus policy to the firewall.

Introduction

Network-Based attacks became quite common once it was demonstrated they were possible. As they grew more complex, it became important not only to detect them, but also to block them. Though the industry originally deployed Intrusion Detection Systems (IDS), which identified specific attack code targeting specific vulnerabilities and alerted people, it has since moved on to Intrusion Prevention Systems (IPS). Though this change was originally viewed as risky because false positives could take a network offline, the technology has matured and is now very reliable.

The FortiGates leverage the CPRL and the Content Processor (CP) ASIC to implement IPS. When you configure your firewall to allow connections to your server, you increase the risk of attacks crossing trust boundaries. So, in general, if your network is connected to another network that is less trustworthy, you should consider running IPS.

While IPS has traditionally been used for edge-based protection as something of a firewall “backup”, it is usually more effective to tie it into the network segmentation process. Thus, if you have servers that you isolate to a different network and dedicate a FortiGate interface to that traffic, you can activate IPS and protect against both internal and external attacks. This helps protect against attackers focusing on vulnerable operating systems and applications as well as simplifying various aspects of regulatory compliance.

Before you Configure IPS (Sizing and Design steps)

IPS is potentially resource intensive, so any deployment should be done with care. You must understand how IPS works: responsibility of the engine, and how signatures function.

The IPS engine is a “smart sniffer” that catches network traffic and compares it traffic against a signature database, where each signature represents a known attack. Properly written signatures tell the IPS engine what to look for without triggering false positives. Ideally, these signatures match against the behavior of an attack and are, over time, tuned to reduce false positives.

As seen in Figure 6.7, an IPS signature has several properties that:

Before you configure your system, you must decide what will be scanned. You may wish to review network segments to identify which contain sensitive data, which operating systems are running or which applications are installed. This way, you won’t have to enable all signatures.

There is always great temptation to enable more than what is needed, as this increases your visibility as to what is occurring within your network. Most people generally start by over-enabling to help get understanding about the network. However, this should be reduced over time, as each event that IPS triggers should be analyzed according to your incident management system.

Once you have decided which traffic will be scanned, you should consider logging. Some attacks might warrant no logging, if they are low risk. Others should be logged for future audit purposes and still others should have a pull packet capture run so that they may be analyzed by the forensics team at a later date. Also, keep in mind that as the attacks against the network are specific to operating systems and applications, and the FortiGate’s checks are simplified versions of these, they will never be perfect. Thus, you will constantly be tuning your environment. You should also consider how you will address events that trigger on another system like server-side AntiMalware or Applicaton Whitelisting. Any true event that occurs there will likely have bypassed the FortiGate and are therefore false negatives.

FortiGates can leverage quarantines as an optional response to a triggered signature. While this is a very useful feature, you should think about it with care. A badly configured quarantine can lead to a self-inflicted Denial of Service (DoS) as, in the event of a false positive, the entire local network could be brought down. Thus, review any signatures that you wish to link to a quarantine for a long period of time (weeks, months, etc.). Basically, if your environment has processes that run once a week, testing for a week should be sufficient. However, if you have monthly processes, you may have to go longer.

You should also consider how you wish to respond to Denial of Service (DoS) attacks. To defend against these attacks, the only possible measure that can be implemented on the target side is measuring the frequency of the requests, and if they exceed what the infrastructure can support, break the flow. The FortiGate can do this, but you must perform your calculation carefully so you do not accidentally block legitimate requests. Trial and error testing works best.

Finally, you might want to verify that your Network Time Protocol (NTP) configuration is appropriate. Connect all servers and network equipment, including the FortiGate, to that NTP Server. While this is not required, it will greatly simplify any IPS analysis, as you could easily compare logs on many systems. This is essential if you must do forensic analysis on the attacks that you face. To review NTP on the FortiGate, you can use the following commands:

How IPS Works in the FortiGate

The first configuration step involves defining global IPS parameters for your environment. Possible values are explained after the comment (//) character.

The algorithm parameter tells the IPS engine how to do signature matching. High is faster but more memory, so it should be uses when performance is important. This mode is only used when IPS and Application Control are the only content inspection feature used. Low is slower but also uses less memory. Engine-pick is the default and bases its choice on the amount of memory available and the type of inspections being performed. In general it is safe to leave it that way.

anomaly-mode tells the engine how anomaly events (DoS-related events) will be caught: continuous blocks all the traffic once the threshold is exceeded, and traffic is allowed once the threshold is reached again. periodical blocks only the packets above the threshold, allowing all the packets below the threshold.

engine-count limits the number of IPS engine processes running on the FortiGate. If the value is changed from the default, you must ensure that you are not exceeding the capabilities of your CPU and memory. Tune this parameter only if IPS is the primary content inspection analysis performed. More IPS processes may result in better performance, but could also overload the system if they exceed your available hardware.

fail-open tells the IPS engine how to behave if, for some reason, the IPS engine becomes unresponsive. Leave it enabled on environments where availability takes precedence over security, but disable it if security matters more.

ignore-session-bytes identifies the number of bytes to be analyzed in a session. The larger the amount, the more memory will be used. The default is 204,800 bytes or around 200 kilobytes. The assumption is that if a session is malicious, the attack will be in the first 200 kb. If there is no indication of a problem, the rest of the session will be ok.

session-limit-mode tells the DoS sensors how to count sessions. By default, the FortiGate uses a heuristic formula to estimate the number of sessions. This is less CPU intensive but also less accurate. If, for example, you define a threshold of 100,000, you could trigger the limit with 99,500 or 101,000 connections. If you set it to accurate, more CPU will be used, but the count will be exact.

socket-size defines the amount of memory devoted to holding packets for the IPS engine. You usually do not need to change this, but if you require RAM for extra uses, you may wish to do so. You can also increase it if IPS plays an important role in your protection scheme.

traffic-submit tells the FortiGate whether or not key attack metrics will be submitted to FortiGuard for further analysis. Enable it to ensure Fortinet continues enhancing IPS engine and signatures.

Once the global parameters are properly tuned, you will need to create IPS profiles that cover two areas: Misuse detection (IPS Sensor) and Anomaly detection (DoS Sensor).

To create an IPS Sensor you must have first determined what you want to protect. Let’s say that you have only Windows and Linux server and that they are running E-mail (SMTP, POP3), Web, and FTP. Further, you only wish to enable protection against “critical” and “high” severity threats. Finally, you want to enable all these signatures regardless of whether Fortinet disables them by default.

Other properties of the signature filter that were not used in the example above include:

set application—Filters based on application, such as Apache or MySQL. Typing a “?” will give you a list of available options.

set log—When set to “enable”, forces all signatures to be logged. When set to “disable”, forces them to not be logged. Otherwise, the “default” setting allows each signature to log or not based on its own configuration.

set log-packet—Enables packet logging for the signatures that match the filter.

set quarantine—Blocks communication for a period of time upon triggering the signature. attacker blocks all communications from the IP address identified as source of the attack. both blocks only the traffic between the attacker and the victim, leaving the attacker free to send information to other systems behind the FortiGate. interface will disable the interface itself, blocking all traffic, which can be dangerous depending on the interface that triggers. Be careful with this setting as it could cut your network completely off from others.

set quarantine-expiry—Only visible if quarantine is set to “attacker”, “both”, or “interface”. Configures the amount of time (in minutes) to activate the quarantine block.

set quarantine-log—Configures whether or not a quarantining event will be logged.

Assigning an IPS Sensor to a firewall policy is similar to assigning any other Content Inspection:

IPS sensors detect misuse, but a completely different sensor is used to detect anomalies. These are caught with DoS Sensors. The DoS Sensors allow you to precisely define traffic patterns. The parameters below are groups based on the modes in which they are affected.

Anomaly Mode

tcp_syn_flood—TCP SYN packet rate (packets/second) to a single destination address.

udp_flood—UDP packet rate (packets/second) going to a single destination IP address.

udp_scan—UDP packet rate (packets/second) coming from a single IP address.

icmp_flood—ICMP packet rate (packets/second) going to a single IP address.

icmp_sweep—ICMP packet rate (packets/second) coming from a single IP address.

Session Limit Mode

tcp_src_session—Number of TCP sessions coming from a single IP address.

tcp_dst_session—Number of TCP sessions going to a single IP address.

udp_src_session—Number of UDP sessions coming from a single IP address.

udp_dst_session—Number of UDP sessions going to a single IP address.

icmp_src_session—Number of concurrent ICMP sessions coming from a single IP address.

icmp_dst_session—Number of concurrent ICMP sessions going to a single IP address.

If you wish to configure a DoS sensor to stop SYN flood at a rate of 10,000 packets per second from the Internet while simultaneously quarantining and logging more than 7000 connections for 10 min between a potential attacker and one of your servers, you could do as follows:

Next, you just assign this profile to a policy. In this example, we are applying to all source and destination addresses, but we could also specify a firewall object here. We could also restrict by protocol if we wished.

Introduction

Web Content Filtering is a simple technology, but one with a tremendous impact. It basically analyzes two items for each URL requested: the category of the site and the content of the page. While similar to DLP in concept, it does not look for sensitive content and block based on what it finds. Instead, it identifies the category of the site and makes a determination based on that.

Reasons for using Web Content Filtering range from wanting to improve internal productivity, keep users off of dangerous and illegal sites or restrict sites based on the morals of those in charge of the organization. In general, the need to block content for whatever reason, can be met with Web Content Filtering.

How Web Content Filtering Works in the FortiGate (Sizing and Design steps)

As mentioned earlier in this chapter, the Web Content Filter (WCF) uses online, real-time updates. Thus, any website that you are browsing to is compared against the list maintained by FortiGuard and the decision is made in the moment.

Since the database is stored on the FDN and not locally, you get a more rapidly updating list at the cost of not being able to directly edit it yourself. Luckily, the FortiGuard team has tools in the FortiGuard portal (http://www.fortiguard.com) that allow you to both verify a URL’s category and, if you disagree, suggest a change. Also, if the web page is not classified (which, while rare, does happen), you can submit the URL and a FortiGuard Analyst will classify it for you. Average response time is less than 48 h.

When a user browsing through a FortiGate requests a Web page that has not yet been classified, it is passed to a list of URLs that will be analyzed and pre-classified by automated mechanisms. Among other things, the number of times that the page has been requested is taken into account so popular but unclassified are reviewed first. If the automated mechanism can classify to an acceptable certainty level, then the classification is uploaded immediately. If, however, the automated mechanism is uncertain, a FortiGuard analyst will review it manually.

Configuring Web Content Filtering

There are two types of Web Content Filter: Regular and FortiGuard Web Content Filter.

For Regular Web Filter, you must decide on a list of words to detect on a web page and the score for each word. The score is a numerical value that is cumulatively added for each occurrence of a detected word, though each specific word only counts once. Our editors will not use actual profanity, so here is an example of blocking web pages that contain the names of planets.

To activate it, we must first assign this configuration to a Web Content Filter profile. The threshold is set to 10, so both words must be present to trigger the action.

Finally, we must assign this list to a firewall policy. However, before we do that, let’s configure a profile with FortiGuard Web Filtering. Suppose, we want to block security risks or the categories, Malicious Websites, Phishing, and Spam URLs. Everything else will be allowed.

Once the WCF Profile has been defined, it can be assigned to the firewall policy.

Once this is configured, the system will block categories not allowed by the Profile.

Bear in mind, the above example was to restrict users based on the IP address they belong to. In this case, all devices behind the interface switch, regardless of their IP address, will be filtered. We can also use authentication to apply Web Content Filtering to only a group of users, based on what user group they belong to. It is also possible to apply more (and different) Content Inspection mechanisms to several groups of users, so guests are more restricted in the type of Web Pages they can access via the corporate Internet connection and get applied stricter Application Control and Antivirus configurations, for example. But discussing user authentication is beyond the scope of this chapter. In general, once the FortiGate authenticates a user and identifies it as part of a group, it can use that information to apply to the user a set of controls by using UTM profiles, adequate to the type of user being identified.