Allgemein – Tech Blog

23. Juni 202124. Juni 2021

BOLL Konsolenkabel

Netzwerk & Security Administratoren kennen die Problematik. Um Zugriff auf eine serielle Konsole zu bekommen, benötigt es einen Adapter, da kaum mehr ein Notebook einen alten DB9 (DE-9) Anschluss hat. Kein Hersteller liefert aber ein USB Konsolenkabel direkt auf RJ45 Ports, welche heute bei praktisch allen Netzwerk & Security Devices der Standard sind.

Die nervigen Adapter und die teilweise mühsame Treiber Unterstützung hat uns bewogen, ein eigenes Boll Konsolen Kabel entwickeln zu lassen. Folgende Bilder illustrieren das schön:

Konsolen Access früher:

22. Juni 202128. Juni 2021

PaloAlto EDL Hosting Service

If you want to configure rules for Saas services on the PaloAlto Firewall, you can do this using the App ID for the particular service, or you can use the IP addresses, Domains or URLs of the service in the policy.

However, since Saas services typically do not use only one IP address, domain or URL, and since these can change dynamically, it requires a dynamic list that is constantly updated automatically.

PaloAlto offers this service as «EDL hosting service». External Dynamic Lists (EDL) are dynamic lists that can contain a list of IP addresses, domains or URLs. These lists are periodically queried by the firewall and updated accordingly. These EDL lists can then be used in various policies. Due to the automatic update of the lists, they are always up to date. There is also no need to commit the configuration if the list changes.

16. Juni 20219. Juli 2021

Windows update breaks SSO event log readers (FSSO, PAN UIA, WG ELM)

Microsoft has released KB5003646 on the 6th of June 2021. Part of this update is a security hardening measurement to align with recommendations as a conclusion out of CVE-2021-31958.

As a known issue of this KB5003646, microsoft has noted in the release notes: «After installing this or later updates, apps accessing event logs on remote devices might be unable to connect.»

This is exactly what is happening on Fortinet FSSO (FSSO with FortiGate, as well as FSSO over the FortiAuthenticator) and Palo Alto Networks User-ID Agent. They are not working anymore after the installation of Update KB5003646.

27. Mai 20217. Juli 2021

FragAttack: Security Flaws in all Wi-Fi devices

In the last few days, more and more articles about vulnerabilities in the Wifi area have appeared. These FragAttacks (fragmentation and aggregation attacks) which is a collection of new security vulnerabilities affects Wi-Fi devices from different vendors.

heise.de: FragAttacks: Neue Angriffe gefährden nahezu alle WLAN-Geräte (German article)

There is a separate web page with more information about this attack:
https://www.fragattacks.com/

On this page we collect information from our vendors so that you can react accordingly and provide information to affected customers.

803 total views, 3 views today

4. Mai 202117. Mai 2021

DIY: FortiGate HQIP self-loopback cable or plug

On some FortiGate models, you are being asked to connect a self-loopback cable on some ports during the HQIP test. This request looks like the following CLI output:

2. Mai 20215. Juli 2021

Fortigate und Swisscom TV – zum dritten

Unser letzter Beitrag zur Konfiguration einer Fortigate, um zuhause auch Swisscom TV durch die Fortigate zu bekommen, ist schon eine zeitlang her. Deswegen hier mal wieder ein aktueller Beitrag mit einer Fortigate auf FOS 7.0.0 (der auch mit 6.4.5 getestet wurde).

In diesem Beispiel hängt die Swisscom TV Box am DMZ Port der Fortigate und bezieht von dort eine DHCP Adresse, welche per DHCP Reservation fixiert wird:

1,097 total views, 3 views today

14. April 202117. Mai 2021

Exchange Pwn2Own Vulnerability April 2021 (Yes, a new one – it’s not Hafnium anymore!)

Let’s mention the important things first: Please patch you vulnerable Exchange 2013, 2016 and 2019 immediately! The page msxfaq has published an infosite to this vulnerability including the instructions how to fix your Exchange.

Some security researchers have demonstrated three high risk vulnerabilities for exchange server systems. Microsoft has published information about the vulnerability today and even has a patch for the problem already in place.

12. März 202117. Mai 2021

Exchange Hafnium Vulnerability March 2021

Even though we, as Boll Engineering AG, are not associated in any way with the affected product, a lot of our customer reported, that they have vulnerable systems in place and may be affected by this bug. We have been asked if IPS signatures and WAF patches are already implemented. Therefore we decided to post this blog to raise the awareness of this vulnerability once more, even after the broad press has already published a lot of releases regarding this matter.

This blog post regards the following CVE reports:

3. März 202117. Mai 2021

How to transfer a FortiGate configuration to a newer model

During the lifecycle of firewalls, they are often replaced with a newer model, but you would like to keep the configuration. In this case, there are several possibilities, which we present in this blog post:

1. FortiConverter Service
2. FortiConverter Tool
3. Partial Config Transfer
4. Full Config Transfer

Den deutschen Artikel dazu finden Sie hier: So übertragen Sie eine FortiGate Konfiguration auf ein neueres Modell

2. März 20212. Mai 2021

Netzwerk Subnettierung

Öfters sehen wir Fragen oder Probleme zur korrekten Subnettierung von Netzen. Mit dem folgenden Raster kann man schnell und einfach die richtige Anzahl Host oder die Subnetzmaske herausfinden.

Die erste Adresse des Subnetz nennt man Netzadresse. Diese kann nicht für Hosts verwendet werden (Bsp. 192.168.10.0 bei einem Subnetz von 255.255.255.0 oder /24)

Ebenso die letzte Adresse des Subnetz. Diese ist die Broadcast Adresse und steht Clients nicht zur Verfügung (Bsp. 192.168.10.255 bei einem Subnetz von 255.255.255.0 oder /24)

Die verbleibenden IP Adressen können von Hosts genutzt werden (Anzahl Hosts in der Tabelle, also 256-2= 254 bei einem Subnetz von 255.255.255.0 oder /24)