Tag Archives: FortiGate Firewall

FortiGate Next Generation Firewall leverages dedicated security processors and threat intelligence security services from FortiGuard.

How to use network manager systemd-resolved

Ubuntu uses the resolvconf program to configure local DNS resolution. The resolvconf package includes a simple database and a runtime for dynamically modifying nameserver information.

How to disable Ubuntu resolvconf

Typically, the program resolvconf runs through a network interface to push routines such as ifup, ifdown, NetworkManager, dhclient, and pppd, or local nameservers such as dnsmasq to update the DNS information.

If static IP addresses and DNS records are used on a host, the resolvconf package should be deactivated under Ubuntu, so that the DNS configuration from the dnsmasq daemon is not automatically made, the configuration that has been edited in /etc/resolv.conf and /etc/network/interfaces will otherwise be overwritten by the resolvconf program.

Disable resolvconf

$ resolvconf --disable-updates

Disable resolvconf from boot level and quit the program.

$ systemctl disable systemd-resolved.service
$ service systemd-resolved stop

Customize the Network Manager with default DNS.

$ vi /etc/NetworkManager/NetworkManager.conf
..
dns=default
..

Remove the symlink resolv.conf under /etc.

$ rm /etc/resolv.conf

and create a new resolv.conf file with the nameservers. in this example, it’s Google Public DNS.

  On a local network or ADS the internal nameservers should be used.

$ vi /etc/resolv.conf

nameserver 8.8.8.8
nameserver 8.8.4.4

Delete the resolv.conf file of the systemd configuration program.

$ rm /etc/systemd/resolved.conf

change the configuration.

$ service network-manager restart

The nameservers can also be defined in the interface configuration.

$ vi /etc/network/interfaces

auto lo
iface lo inet loopback

auto ens160
iface ens160 inet static
  address 10.10.0.8
  gateway 10.10.0.1
  netmask 255.255.255.0
  network 10.10.0.0
  broadcast 10.10.0.255
  dns-nameservers 8.8.8.8 8.8.4.4
  dns-search my.local

The interface name (ens160) may differ and must correspond to that of the respective host.

  The /etc/resolv.conf file should not be missing.

Now enable the new network settings it will be read into memory.

$ /etc/init.d/networking restart

Troubleshooting using DNS

Many network issues are due to incorrect DNS or incorrect configuration of resolver. In a home network there is often no internal DNS, whereby the router or the firewall can be used as a nameserver, such as the Linksys or Netgear router. Basically, it should be ensured that the firewall used has a DNS cache, with semi-professional firewalls such as the FortiGate that not every model provide such a cache. For open source-based firewalls most provide a cache through DNS forwarder or dnsmasq.

After open up a command prompt will changes to the nameservers in Windows, the DNS cache should be reset.

C:\> ipconfig /flushdns

For Linux, the DNS cache can be reset out from terminal, with one of the following commands, depending on which service is installed.

$ sudo /etc/init.d/nscd restart
$ service nscd restart
$ service nscd reload
$ sudo /etc/init.d/dnsmasq restart
$ service dnsmasq restart
$ rndc reload

In the Mac OS X terminal as root.

$ lookupd -flushcache

If there is no internal DNS in the local network, the name servers of the Internet provider can be used, or may the Cloudflare public DNS.

1.1.1.1 1.0.0.1

Example of a nameserver querying its provider on Windows.

C:\> nslookup -type=ns green.ch
Server: dns1.agrinet.ch
Address: 81.221.250.11

Non-authoritative response:
green.ch nameserver = dns2.agrinet.ch
green.ch nameserver = dns1.agrinet.ch

dns1.agrinet.ch internet address = 81.221.250.11

Example nameserver lookup query on Linux.

$ host -t ns green.ch
green.ch name server dns1.agrinet.ch.
green.ch name server dns2.agrinet.ch.

host dns1.agrinet.ch & host dns2.agrinet.ch
dns1.agrinet.ch has address 81.221.250.11
dns2.agrinet.ch has address 81.221.252.11
dns2.agrinet.ch has IPv6 address 2a01:2a8:2001:252::11

A ping -n1 resolves addresses to host names with parametersa and4 for IPv4 address.

C:\> ping -4 -n 1 -a www.google.com

Ping runs for www.google.com with [216.58.201.4]32 bytes of data:
Response from 216.58.201.4: Bytes=32 Time=32ms TTL=50

Ping statistics for 216.58.201.4:
    Packages: Sent = 1, Receive = 1, Lost = 0
    (0% loss),
Approx. times in millisec.:
    Minimum = 32ms, Maximum = 32ms, Mean = 32ms

Show the current DNS nameservers available use systemd resolver.

$ systemd-resolve --status

FortiGate subnet overlapping remapping

In a site-to-site VPN configuration, the private IPv4 Subnet addresses at each scheduled end can often be the same. The problem can be solved by remapping the private IPv4 addresses using virtual IP addresses (VIP).

VIPs allow computers in its overlapping private subnets to be assigned a different range of IP addresses, and the subnets can be used transparently. The FortiGate appliance converts the VIP addresses to the original addresses. This means that if PC1 starts a session with PC2 at 10.31.101.10, FortiGate_2 the session to PC2, which actually has the IP address 10.11.101.10.

Figure shows – Finance Network VIP is 10.21.101.0/24 and the HR network has 10.31.101.0/24.

example overlapping subnets
Overlapping subnets Example

Configuration of a route-based VPN solution:

Create an IPsec Phase 1 and Phase 2, as you would normally do for a route-based VPN. This example refers to the resulting IPsec interface as IPsec_FGT1_2_FGT2.

Configuring Virtual IP (VIP) Mapping, under Policy & Objects > Virtual IPs > Create New

New Virtual IP
New Virtual IP

Create IP Pool for Subnet Remmaping under Objects – IP Pools.

new dynamic ip pool
New IP Pool

Configure an outbound policy on both FortiGate, under Policy & Objects > IPv4 Policy > Create New, Leave the Policy Type on Firewall and the Policy Subtype as the address:

Policy outbound
Policy outbound

To configure the inbound policy:

new policy
Policy inbound

To configure the Static Route:

new static route
Static Route

Repeat this process on both FortiGate, FGT1 and FGT2, taking into account the corresponding subnets, 10.21.101.0/24 and 10.31.101.0/24.