Erik's Weblog » Netadmin http://erik.labianca.org/blog A blog. About stuff. Tue, 28 Dec 2010 23:05:22 +0000 en hourly 1 http://wordpress.org/?v=3.2.1 WatchGuard Core x750e first impressions http://erik.labianca.org/blog/2006/12/watchguard-core-x750e-first-impressions/ http://erik.labianca.org/blog/2006/12/watchguard-core-x750e-first-impressions/#comments Sat, 09 Dec 2006 03:41:59 +0000 erik http://blogs.ilsw.com/erik/2006/12/08/watchguard-core-x750e-first-impressions/ Continue reading →]]> So I finally got my WatchGuard eval unit. 2 months after I would have liked, but c’est la vie, I guess they had some employee turnover over there and my box got lost in the shuffle. Upon opening the box, everything looks very nice, and yes, its all red, and very cute looking. Turning it on, however, the LCD screen just says ‘Booting OS …’ and never makes it farther… Not a great sign.

There is, however a yellow sticker on top that says I have to install Fireware Appliance Software on the device, and that I must hold down the up arrow on the front while turning it on. This I can do. So I do. And the box just says ‘Booting OS …’ and never makes it further. So it’s time to get all sorta of ninja-hacker-style on it’s ass.

I plug in the included serial console cable, install [tutty](http://putty.dwalin.ru/) on my newly vistafied workstation and fiddle around until I determine that the watchguard is using 115200,n,8,1. This is what I see:


Press any key to continue.

So good little monkey that I am, I smash the spacebar a few times, and get this


 +-------------------------------------------------------------------------+
 | Red Hat Linux (2.4.26-wgrd)                                             |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 |                                                                         |
 +-------------------------------------------------------------------------+
      Use the ^ and v keys to select which entry is highlighted.
      Press enter to boot the selected OS, 'e' to edit the
      commands before booting, 'a' to modify the kernel arguments
      before booting, or 'c' for a command-line.

    GRUB  version 0.93  (638K lower / 515072K upper memory)

 [ Minimal BASH-like line editing is supported.  For the first word, TAB
   lists possible command completions.  Anywhere else TAB lists the possible

Ok, so they're running a redhat variant. Well, I knew this was a linux based product, and I know redhat, so in general this is good news. 15 seconds later, grub times out and I see this:


  Booting 'Red Hat Linux (2.4.26-wgrd)'

root (hd0,2)
 Filesystem type is ext2fs, partition type 0x83
kernel /boot/bzImage ro root=/dev/hda3 console=ttyS0,115200 ramdisk_size=256000
 ide=nodma

Error 15: File not found

Press any key to continue...

Uh ok. So this isn't such great news. Getting really fancy and setting the boot loader to boot (hd0,0)/bzImage gives me this:

Pretty standard linux boot spam, but it looks like perhaps we've got a bad CF disk, given the seek errors. The real kicker is that punching the serial number from the back of the box into the 'activate online' page of the WatchGuard website is utterly unsuccessful as well.

In its defense, the red box is at least as good looking as I imagined it, and it IS exactly the solid state Linux 1u rackmount with a lot of Ethernet interfaces i've been looking for. Unfortunately, $3000 + service contracts is an awful lot of money for a cute box with software that doesn't work!

Update 2006-12-10

I spent too much of my weekend poking around with this and posting on the [WatchGuard forum](http://forum.watchguard.com), but I'm pretty convinced that this machine is just DOA. I can't get link lights on any of the Ethernet interfaces (sort of a show stopper for a firewall), and in addition the compact flash card doesn't seem to be loaded with the rescue image, let alone a full firewall OS. I was at least able to get onto the livesecurity website, turns out I'd transposed two digits of the serial number while reading it leaning over the firewall, and caught it when I recopied it from the box.

Being able to get on the website means I was able to get the software, and found out that it requires an explorer extension to complete the installer, which means it won't finish installing on xp64 or vista64. None of it seemed to want to run on vista either, but putting it into compatability mode seems to bring it to the same point as xp, meaning it won't finish installing because I can't activate the toolbar in a way it can find it since it installs into 32 bit explorer. The good news is that the important parts of the install do seem to have completed, at least all the files are on the disk. I was able to try to use fbxinstall to reinstall my CF image, but apparently that does'nt work on the e-series boxes, so I don't know if it failed due to bum hardware or not. Maybe its just me, but it seems making your installer dependent on activating a shell extension, for a firewall product of all things, seems like some dumb decision making.

I've opened a support ticket and started some dialog, but I'm not holding a lot of hope that I'll actually get a replacement unit in here in time to have it usable over the holidays. The responses I've gotten to my post on the forums indicate that the general user base of these boxes, 'experts' included, doesn't really have a clue what the underpinnings of the system look like, which is I guess for the most part a good thing. It does, however, tend to reduce the usefulness of their responses to my questions. DOA units also seems to be outside the radar of the average forum denizen, so I'm hoping my box is an isolated case. It does start making HA failover look pretty nice though.

Update 2006-12-11

I got a call from a 'fixer' at WatchGuard who has arranged for me to get a new unit overnighted. He concurs with my assessment that the unit is very much DoA. Kudo's to my sales guy and watchguard for stepping up on this one, I'm awaiting a functional unit with baited breath!

]]> http://erik.labianca.org/blog/2006/12/watchguard-core-x750e-first-impressions/feed/ 0 Security Appliance Roundup Part 1 http://erik.labianca.org/blog/2006/10/security-appliance-roundup-1/ http://erik.labianca.org/blog/2006/10/security-appliance-roundup-1/#comments Tue, 10 Oct 2006 15:55:06 +0000 erik http://b.www.ilsw.com/blogs/erik/2006/10/10/security-appliance-roundup/ Continue reading →]]> So I want to simplify and strengthen our network security at the office. Currently we’re using a mishmash of cisco IOS ipsec, pptp, cbac/NAT and linux iptables host based firewalls. I’d like to centralize everything, and add a more reliable vpdn solution to the mix. In addition, I’d like better logging and traffic shaping control.

### [Cisco 2600 with IOS 12 advanced firewall](http://www.cisco.com) ###

I’ve been running this for the last couple of years, on 2600 class hardware. In general, its a very complete solution, but configuring it can be extremely trying. I can’t even remember the number of times I’ve been stumped by some issue that ‘should be working’, only to find out a month or two later that the problem was software revision I was using. Cisco is very difficult to work with wrt getting firmware updates for their software, and I typically don’t have good luck findout out what other version I’d need, anyway. The cisco ipsec vpn implementation seems to be solid, as are their routing abilities. The CBAC packet inspection system is where the cisco starts to weaken as a firewall platform, however. Even just inspecting standard TCP traffic can easily put the 2600 under enough load that I can’t really afford to run it between my internal network and DMZ.

Cisco’s single file configuration, plethora of hardware interfaces, utterly complete routing support and general hardware reliability are second to none however. If it were easier to get a bunch of ethernet interfaces tied into a 2600, and it was in general easier to get ahold of firmware updates and modules for the hardware I’d be hardpressed to want to change.

We’ve also been using Cisco hardware for our vpn endpoints. At this point they consist of a soho91 and a pair of 857w’s. In general, these are very capable endpoint routers, and obviously their ipsec vpn connectivity to the 2600 is second to none. However, they lack support for any sort of split horizon dns, so using dns at client sides is trying at best. In addition, I’ve not gotten so far as to even attempt to control access to the vpn at the remote ends, so I’m stuck trusting that anybody managing to connect to one of the remote endpoint networks (wired, wireless, or otherwise) is trustworthy. I believe I ought to be able to apply CBAC or packet filter rules to traffic arriving from the VPN but the complexity of figuring out how to apply them in the face of cisco’s ip stack traversal order has prevented it.

In addition, the ios nat implementation doesn’t seem to be able to do any sort of hairpinning, which is pretty frustrating since our mail server is snatted through the router. This means I can’t send smtp traffic from any of the vpn endpoints currently.

### [M0n0Wall](http://m0n0.ch) ###
This is another very nicely integrated freebsd based web managed firewall implementation. It is designed to run on embedded hardware such as Soekris or WRAP single board computers. It supports IPSEC tunnels, split horizon dns using dnsmasq, but again is targetted fairly directly at the SOHO market, with no support for vpdn or static routing. I used it for several months running on my soekris 3ethernet box and had no problems with the functionality it provided.

### [LEAF](http://leaf.sourceforge.net) ###
This is an interesting amalgam of linux software packages for embedded hardware. Unfortunately, the price to be paid for the flexibility of a full linux system is complexity. You’ll have to edit the files in /etc folder on a ramdisk, and figure out which package they are a part of in order to get them ‘backed up’ to compact flash so they will be available post reboot. The firewall portion of LEAF is typically handled with shorewall.

### [Shoreline Firewall](http://www.shorewall.net/) ###

This is basically an iptables configuration script. It uses a series of files (typically placed in /etc/shorewall) defining things like interfaces, rules, and policies, and turns it all into a complete set of iptables rules. It seems to be able to configure just about any aspect of iptables you might want to, but the downside is that it generates copious amounts of rules, which makes reading the iptables -L output the old fashioned way pretty tough. The other downside is obviously that you have to edit the files, and do it correctly, or you risk blowing up all kinds of stuff.

### [Proxmox Firewall](http://www.proxmox.com) ###
This appears to be another shorewall based firewall solution. I did manage to download and install it, but in its install process it appears to have assigned itself an IP address using dhcp and then started using it statically, and I have no idea what it is or how to get it back. Oh well.

### [Gibraltar](http://www.gibraltar.at/) ###
Based on debian . Looks to be utterly feature complete (including multiple dmvpn options, heartbeat failover support, lots of proxies, etc), and it still knows how to back itself up / restore easily. Runs off read only media, and according to their site they have some VERY nice hardware solutions for a reasonable price. What I don’t like is that the UI is anything but user friendly. It’s basically just a series of web forms to cover up the standard debian configuration files. When I tried to save the configuration to my vmware hard drive, it wouldn’t work, either, so at this point I’m gonna have to backburner this option.

### [Smoothwall (GPL)](http://www.smoothwall.org) ###
This is very nicely integrated firewall package. It has explicit dsl modem support, and a fairly strong community and selection of add-on packages. However it is clearly aimed at the SOHO market. It doesn’t support multiple DMZ’s, nor any static routing. The web interface appears to be very nice, but you really have to be sure your needs will fit directly within their model.

### [IPCop](http://www.ipcop.org) ###
This is the ‘more open source’ fork of smoothwall. It adds support for the snort IDS, complete with automatic rule updates, a ‘blue’ dmz interface (for wireless networks, I think), and in general is another very nice package. But again it only supports ipsec vpn (although it will handle dynamic vpn terminals using dyndns). It also doesn’t support any static routing that I can find.

### [Smoothwall Advanced Firewall](http://www.smoothwall.net) ###
This is the commercial version of smoothwall. They’ve been in the business for a long time, and feature wise this looks like an extremely compelling option. They provided me with a free evaluation license, so I downloaded it and spent a few hours checking it out while running in a VPC. In general it has a quite nice web configuration interface, but again it really isn’t designed for a more complicated network. In particular, it doesn’t appear to have any mechanism to support static routing or layer 2 filtering, making it difficult for me to use my class C block of IP addresses effectively.

]]> http://erik.labianca.org/blog/2006/10/security-appliance-roundup-1/feed/ 0