Drawing Rules

Mon, 04 Jul 2022 00:00:00 +0100

Today I’m using the same technique to draw the rules of the Fortinet devices.

It Looks pretty amazing.

This is a sample of the dot file generated by the parser.

digraph G {
fontname="Arial"
node [fontname="Arial"]
edge [fontname="Arial"]
graph [rankdir="LR",fontsize=9 ];
node [fontsize=9, shape=ellipse];
edge [lblstyle="above, sloped"];
subgraph "_default" {
 cluster=true;
 label="_default";
 style=filled;
 color=lightgrey;
 node [style=filled];
"src15";
"src25";
}
subgraph "VLAN 961" {
 cluster=true;
 label="VLAN 961";
 style=filled;
 color=lightgrey;
 node [style=filled];
"dst15";
"dst25";
}
src15 [
 shape=none
 label = <<table border="0" cellspacing="0">
 <tr>
 <td port="NET_USERS2" border="1" bgcolor="orange">NET_USERS2</td>
 <td>10.10.25.0/24</td>
 </tr>
</table>>
]
dst15 [
 shape=none
 label = <<table border="0" cellspacing="0">
 <tr>
 <td port="NET_IMPRESORAS" border="1" bgcolor="orange">NET_IMPRESORAS</td>
 <td>10.10.61.50-10.10.61.55</td>
 </tr>
</table>>
]
proto15 [
 shape=none
 label = <<table border="0" cellspacing="0">
 <tr>
 <td port="ALL" border="1" bgcolor="#BAB86C">ALL</td>
 <td border="1"></td>
 </tr>
</table>>
]
sec15 [
 shape=none
 label = <<table border="0" cellspacing="0">
 <tr>
 <td align="left" port="" border="1" bgcolor="#C0C0C0">schedule</td>
 <td align="left" border="1" bgcolor="#ffffff">always</td>
 </tr>
</table>>
]
"src15" -> "proto15" -> "sec15" -> "dst15" [label="lan2impresoras", fontsize=9, color="#A9A726"];
src25 [
 shape=none
 label = <<table border="0" cellspacing="0">
 <tr>
 <td port="NET_USERS2" border="1" bgcolor="orange">NET_USERS2</td>
 <td>10.10.25.0/24</td>
 </tr>
</table>>
]
dst25 [
 shape=none
 label = <<table border="0" cellspacing="0">
 <tr>
 <td port="SERVER1" border="1" bgcolor="#00f7ff">SERVER</td>
 <td>10.10.61.10</td>
 </tr>
</table>>
]
proto25 [
 shape=none
 label = <<table border="0" cellspacing="0">
 <tr>
 <td port="RDP" border="1" bgcolor="#E5E4E2">RDP</td>
 <td border="1">3389</td>
 </tr>
 <tr>
 <td port="Windows AD" border="1" bgcolor="#E5E4E2">Windows AD</td>
 <td border="1"></td>
 </tr>
 <tr>
 <td port="PING" border="1" bgcolor="#E5E4E2">PING</td>
 <td border="1"></td>
 </tr>
 <tr>
 <td port="IPERF" border="1" bgcolor="#E5E4E2">IPERF</td>
 <td border="1">5201</td>
 </tr>
</table>>
]
s_g125 [
 shape=none,
 label = <<table border="0" cellspacing="0">
 <tr>
 <td align="left" port="DCE-RPC" border="1" bgcolor="#fffde7">DCE-RPC</td>
 <td align="left" border="1">135</td>
 </tr>
 <tr>
 <td align="left" port="DNS" border="1" bgcolor="#fffde7">DNS</td>
 <td align="left" border="1">53</td>
 </tr>
 <tr>
 <td align="left" port="KERBEROS" border="1" bgcolor="#fffde7">KERBEROS</td>
 <td align="left" border="1">88 464</td>
 </tr>
 <tr>
 <td align="left" port="LDAP" border="1" bgcolor="#fffde7">LDAP</td>
 <td align="left" border="1">389</td>
 </tr>
 <tr>
 <td align="left" port="LDAP_UDP" border="1" bgcolor="#fffde7">LDAP_UDP</td>
 <td align="left" border="1"></td>
 </tr>
 <tr>
 <td align="left" port="SAMBA" border="1" bgcolor="#fffde7">SAMBA</td>
 <td align="left" border="1">139</td>
 </tr>
 <tr>
 <td align="left" port="SMB" border="1" bgcolor="#fffde7">SMB</td>
 <td align="left" border="1">445</td>
 </tr>
</table>>
]
{ rank=same; "s_g125" -> "proto25" [label="Windows AD", fontsize=8, penwidth=2, style=dotted]};
sec25 [
 shape=none
 label = <<table border="0" cellspacing="0">
 <tr>
 <td align="left" port="" border="1" bgcolor="#C0C0C0">schedule</td>
 <td align="left" border="1" bgcolor="#ffffff">always</td>
 </tr>
</table>>
]
"src25" -> "proto25" -> "sec25" -> "dst25" [label="lan2servidores", fontsize=9, color="#A9A726"];
}

Parse Fortinet Config

Sun, 03 Jul 2022 00:00:00 +0100

Some times things that seems easy, tend to be more complicated than expected, and sometimes things that seems complicated, are actually easy.

I love simplicity. Yeah !!

Sure that there is some law about how things tend to compexity, but I’m not going to talk about that. The thing is with the time, and security risks, netkork rules in this devices are getting more and more complex.

I have been working with Fortinet devices for a while, and I have to say that they are very good devices. They have a lot of features, and they are very secure. But, as I said before, the rules are getting more complex, and sometimes is difficult to understand what is happening in the device.

Fortinet on csegura

Drawing Rules

Parse Fortinet Config