DDOS ATTACK MITIGATION FortiDDoS 4.1 Patch 5. Release Notes

Transcription

1 DDOS ATTACK MITIGATION FortiDDoS 4.1 Patch 5 Release Notes

2 FortiDDoS 4.1 Patch 5 Release Notes for B Series Models December 31, 2014 Revision 1 Copyright 2014 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare, and FortiGuard and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable. Technical Documentation Knowledge Base Forums Customer Service & Support Training FortiGuard Threat Research & Response License Agreement Document Feedback techdocs@fortinet.com

3 Table of contents Introduction... 4 What s new... 5 Hardware support... 6 Image checksums... 7 Upgrading... 8 Upgrading from 4.1.x to Upgrading from 4.0.x to New and changed features Resolved issues Known issues Fortinet 3 FortiDDoS 4.1 Patch 5 Release Notes

4 Introduction This document provides a list of new/changed features, upgrade instructions and caveats, resolved issues, and known issues for FortiDDoS 4.1 Patch 5, build FortiDDoS is a network behavior anomaly (NBA) prevention system that detects and blocks network attacks that are characterized by excessive use of network resources. These attacks are known as distributed denial of service (DDoS) attacks. For additional documentation, please visit: Fortinet 4 FortiDDoS 4.1 Patch 5 Release Notes

5 What s new See New and changed features on page 13 and Resolved issues on page 14. Fortinet 5 FortiDDoS 4.1 Patch 5 Release Notes

6 Hardware support This release supports the following hardware models: FortiDDoS 200B FortiDDoS 400B FortiDDoS 800B FortiDDoS 1000B FortiDDoS 2000B FortiDDoS A series models are not supported. Fortinet 6 FortiDDoS 4.1 Patch 5 Release Notes

7 Image checksums To verify the integrity of the firmware file, use a checksum tool to compute the firmware file s MD5 checksum. Compare it with the checksum indicated by Fortinet. If the checksums match, the file is intact. MD5 checksums for software releases are available from Fortinet Customer Service & Support: Figure 1: Customer Service & Support image checksum tool After logging in to the web site, in the menus at the top of the page, click Download, and then click Firmware Image Checksums. Alternatively, near the bottom of the page, click the Firmware Image Checksums button. (The button appears only if one or more of your devices have a current support contract.) In the File Name field, enter the firmware image file name including its extension, then click Get Checksum Code. Fortinet 7 FortiDDoS 4.1 Patch 5 Release Notes

8 Upgrading The web UI and CLI options for updating the firmware are not available in this release. Instead, use the following instructions to update your FortiDDoS. In addition, this release requires a new management information base (MIB) file to support SNMP queries. For information on MIB files, see "MIB support" in the FortiDDoS Handbook. Upgrading from 4.1.x to Use the following steps to upgrade from 4.1.x. Steps for upgrading from 4.0.x version are provided below. Upgrade from FortiDDoS 3.x is not supported. Important: This upgrade removes the existing configuration files from the system. If you want to avoid re-configuring the system, follow the instructions in step 1 carefully. These instructions save and modify the configuration file so that you can restore it later. This upgrade process preserves your traffic history. 1. Optional. If you want to maintain your configuration across the firmware upgrade: a. Back up the current configuration. Use System > Maintenance > Backup & Restore to save your current configuration and then save the backup file as a.txt file. For example: FDD-FI400B txt b. Open the configuration file in a text editor and make the configuration changes that are required for this upgrade: i. In the first line of the configuration, change FI<model> to FI<model> , where <model> is the model number of the appliance that you are upgrading. For example, change the following first line: # config-version=fi-2kb fw-build content:6-0-0 to # config-version=fi-2kb fw-build content: Upgrade the firmware: a. Download the new firmware image. Contact the Advanced Technology SEs or Customer Support to get this firmware. It is not on the FortiCare download site. b. Copy the file to a location you can access from the FortiDDOS appliance using TFTP. c. Connect to the FortiDDOS appliance console. d. Reboot the system and, when prompted, press any key to display the BIOS configuration menu. e. Select option G so that the system can get the new firmware image from the TFTP server and load it when it reboots. The following example shows the CLI sequence: Fortinet 8 FortiDDoS 4.1 Patch 5 Release Notes

9 FI800B # exe reboot This operation will reboot the system! Do you want to continue? (y/n) y System is rebooting... The system is going down NOW!! Please stand by while rebooting the system. FortiDDoS-800B (19: ) Ver: Serial number:fi800bxxxxxxxxxx RAM activation CPU(00:000306a9 bfebfbff): MP initialization CPU(01:000306a9 bfebfbff): MP initialization CPU(02:000306a9 bfebfbff): MP initialization CPU(03:000306a9 bfebfbff): MP initialization CPU(04:000306a9 bfebfbff): MP initialization CPU(05:000306a9 bfebfbff): MP initialization CPU(06:000306a9 bfebfbff): MP initialization CPU(07:000306a9 bfebfbff): MP initialization Total RAM: 8192MB Enabling cache...done. Scanning PCI bus...done. Allocating PCI resources...done. Enabling PCI resources...done. Zeroing IRQ settings...done. Verifying PIRQ tables...done. Boot up, boot device capacity: 15272MB. Press any key to display configuration menu [G]: Get firmware image from TFTP server. [F]: Format boot device. [B]: Boot with backup firmware and set as default. [I]: Configuration and information. [Q]: Quit menu and continue to boot with default firmware. [H]: Display this list of options. Enter Selection [G]: Please connect TFTP server to Ethernet port "MGMT". Enter TFTP server address [ ]: Enter local address [ ]: Enter firmware image file name [image.out]: FDD_800B-v400-build0151- FORTINET.out 3. Set the management port IP address and gateway IP address using the console. 4. If you saved and edited the configuration file, restore it using the CLI or GUI. 5. If you did not save a configuration file, you must reconfigure the user accounts and system options. Fortinet 9 FortiDDoS 4.1 Patch 5 Release Notes

10 Upgrading from 4.0.x to Use the following steps to upgrade from 4.0.x. Upgrade from FortiDDoS 3.x is not supported. Important: This upgrade removes the existing configuration files from the system. If you want to avoid re-configuring the system, follow the instructions in step 1 carefully. These instructions save and modify the configuration file so that you can restore it later. This upgrade process preserves your traffic history. 1. Optional. If you want to maintain your configuration across the firmware upgrade: a. Document and then delete any ICMP Type/Code service items and any SPP ACLs that use them. The syntax for this type of service has changed. You must re-enter these services after you upgrade. b. Back up the current configuration. Use System > Maintenance > Backup & Restore to save your current configuration and then save the backup file as a.txt file. For example: FDD-FI400B txt c. Open the configuration file in a text editor and make the configuration changes that are required for this upgrade: i. In the first line of the configuration, change FI<model> or FI<model> to FI<model> , where <model> is the model number of the appliance that you are upgrading. For example, change the following first line: #config-version=fi400b fw-build content:6-0-0 to #config-version=fi400b fw-build content:6-0-0 ii. If you have configured IPv6 dual stack features, locate the section in the.txt file that is similar to the following lines: config ddos global setting set ip-v6-dual-stack enable set ip-v6-prefix 96 end Replace the IPv6 prefix settings with the new IPv6 prefix settings. For example, the following lines add settings for the network 2000::/96: config ddos global setting set ip-v6-prefix-length 64 set ipv6-prefix 4001::1:ff:60:1111:4444 end iii. If you have configured IPv6 service protection profile (SPP) policies, locate the section in the.txt file that is similar to the following lines: config ddos global spp-policy edit subnet1 set subnet-id 1 set ipv6 4001:0:0:1::/65 set spp SPP-0 Fortinet 10 FortiDDoS 4.1 Patch 5 Release Notes

11 next end Replace the IPv6 policies with the new IPv6 policies. For example, the following lines add an SPP policy for SPP-0: config ddos global spp-policy edit subnet1 set subnet-id 1 set ip-version IPv6 set ipv6 4001:0:0:1::/65 set spp SPP-0 next end Note: When you restore a backup from 4.1.x, IPv4 SPP policies are preserved. 2. Upgrade the firmware: a. Download the new firmware image. Contact the Advanced Technology SEs or Customer Support to get this firmware. It is not on the FortiCare download site. b. Copy the file to a location you can access from the FortiDDOS appliance using TFTP. c. Connect to the FortiDDOS appliance console. d. Reboot the system and, when prompted, press any key to display the BIOS configuration menu. e. Select option F to format the boot device. f. When formatting is complete, select option G so that the system can get the new firmware image from the TFTP server and load it when it reboots. g. The following example shows the CLI sequence: FI800B # exe reboot This operation will reboot the system! Do you want to continue? (y/n) y System is rebooting... The system is going down NOW!! Please stand by while rebooting the system. FortiDDoS-800B (19: ) Ver: Serial number:fi800bxxxxxxxxxx RAM activation CPU(00:000306a9 bfebfbff): MP initialization CPU(01:000306a9 bfebfbff): MP initialization CPU(02:000306a9 bfebfbff): MP initialization CPU(03:000306a9 bfebfbff): MP initialization CPU(04:000306a9 bfebfbff): MP initialization CPU(05:000306a9 bfebfbff): MP initialization CPU(06:000306a9 bfebfbff): MP initialization CPU(07:000306a9 bfebfbff): MP initialization Total RAM: 8192MB Enabling cache...done. Scanning PCI bus...done. Allocating PCI resources...done. Enabling PCI resources...done. Zeroing IRQ settings...done. Verifying PIRQ tables...done. Boot up, boot device capacity: 15272MB. Press any key to display configuration menu... Fortinet 11 FortiDDoS 4.1 Patch 5 Release Notes

12 ... [G]: Get firmware image from TFTP server. [F]: Format boot device. [B]: Boot with backup firmware and set as default. [I]: Configuration and information. [Q]: Quit menu and continue to boot with default firmware. [H]: Display this list of options. Enter Selection [F]: It will erase data in boot device. Continue? [yes/no]: yes Formatting Done [G]: Get firmware image from TFTP server. [F]: Format boot device. [B]: Boot with backup firmware and set as default. [I]: Configuration and information. [Q]: Quit menu and continue to boot with default firmware. [H]: Display this list of options. Enter Selection [G]: Please connect TFTP server to Ethernet port "MGMT". Enter TFTP server address [ ]: Enter local address [ ]: Enter firmware image file name [image.out]: FDD_800B-v400- build0151-fortinet.out 3. Set the management port IP address and gateway IP address using the console. 4. If you saved and edited the configuration file, restore it using the CLI or GUI. 5. Re-enter any ICMP Type/Code services and SPP ACLs that you deleted in the earlier step. Important: In FortiDDoS 4.1, the system recommended thresholds are determined differently from previous firmware versions. After you upgrade to 4.1, Fortinet recommends that you regenerate traffic statistics and then review and reset the thresholds using Protection Profiles > Thresholds > System Recommendation. For URLs, FortiDDoS now sets the HTTP headers threshold based on the maximum rate it measures across all of the hash indexes. For ports above 1023, FortiDDoS now sets thresholds based on the maximum rate it measures across ports that are greater than Fortinet 12 FortiDDoS 4.1 Patch 5 Release Notes

13 New and changed features Table 1 lists new features. Table 1: New features Bug ID Description SPP Thresholds Changed defaults on the Protection Profiles > Thresholds > System Recommendation page. In 4.1.5, the default low thresholds are as follows: Layer Layer Layer In 4.1.5, the default percentage adjustments are as follows: Layer Layer Layer Changes required for FDD-2000B-USG license keys. Fortinet 13 FortiDDoS 4.1 Patch 5 Release Notes

14 Resolved issues The following list of issues does not include every bug corrected with this release. For inquires about a particular bug, please contact Fortinet Customer Service & Support. Table 2: Resolved issues Bug ID Description SPP Thresholds Resolved an issue with port ranges in the generated system recommended configuration , System Hardened the operating system to avoid vulnerabilities associated with Heartbleed, POODLE, and other issues SPP Thresholds Increased the maximum number of entries when using system recommended thresholds. The maximum was changed from 512 to 1027 entries (system-wide) SPP Thresholds Thresholds were being lowered for well-known ports after system recommendations had been set. Fortinet 14 FortiDDoS 4.1 Patch 5 Release Notes

15 Known issues The following list of issues for this release is not complete. For inquires about a particular bug, please contact Fortinet Customer Service & Support. Table 3: Known issues Bug ID Description FDD-2000B There is an issue with the last 2 SFP+ ports. Ports 15 and 16 are not usable. This does not affect LC ports High Availability The standby appliance might lose the heartbeat interface configuration after a reboot. This causes both appliances to become the master. HA synchronization has been disabled until further notice Upgrade In 4.0.x and 4.1.x, firmware cannot be upgraded via the GUI or CLI. Please read the Upgrade instructions carefully to avoid system issues. Because this issue is ongoing, the GUI links and CLI command have been removed until further notice Reports The Monitor > Aggregate ACL Drops > Aggregate graph does not display data for all Layer 3 drops FDD-1000B/2000B There is an issue load balancing across TP2 ASICs observed with IP Traffic with OPTIONS set in the headers. This might lead to memory errors under heavy load HTTP Method adaptive threshold settings for Methods other than GET are not being updated correctly. This affects thresholds for HEAD, OPTION, TRACE, POST, PUT, DELETE, and CONNECT. If traffic is growing very fast, you might need to run System Recommendations again to adjust thresholds Reports Some reports are corrupted when ed in Word format Destination Penalty setting is not used and will be removed from the web UI in a future release FDD1000B/2000B Interface link always shows "up" in 1000Mbps full duplex mode , SPP Thresholds Table When using system recommended thresholds, the maximum number of entries for TCP Ports, UDP Ports, ICMP Types/Codes, and URLs is 1027 (system-wide). We acknowledge this might not be large enough for high-traffic systems protecting large numbers of servers. Fortinet 15 FortiDDoS 4.1 Patch 5 Release Notes

16 Fortinet 16 FortiDDoS 4.1 Patch 5 Release Notes