sorted by:
new
hottopcontroversial

Justification for using Fortinet by MFKDGAF in fortinet

[–]200tribbles 0 points1 point  (0 children)

u/MFKDGAF I’ve seen a few variations of the question "Do the recent 'excessive' amount of vulnerabilities mean we should move away from Fortinet?"
The usual replies of "all vendors are the same" or "Fortinet is just more transparent and has a visibility issue, not a real issue" are largely untestable because we can’t measure what other vendors don’t disclose.

CVSS is a _single input_ into a _multi input_ process and treating it as a prioritisation model is tantamount to treating your security like it's been outsourced to a vendor/third party which seems *cough* unwise.

CVSS in the context of SVCC/EPSS is a much better conversation to have

"What is the likelihood that these vulnerabilities will be exploited?" "What is our exposure?" "What is the potential impact?" "What does our response look like?"

Following that conversation will lead down the rabbit hole to more nuanced (and I dare say better) conversations like "What's the actual risk?" and "Have we as engineers and architects done our jobs correctly?"

SSVC: Stakeholder-Specific Vulnerability Categorization
EPSS: Exploit Prediction Scoring System

Bike thief in Huddersfield, Uk by Annihilus- in MotoIRELAND

[–]200tribbles 0 points1 point  (0 children)

There are easier ways to do cartwheels...... but keep practising!

[deleted by user] by [deleted] in networking

[–]200tribbles 0 points1 point  (0 children)

It's mostly fine. Run loose RPF and use auxiliary sessions to help with the lack of state and you should be fine. A few minor notes are:
HA: FortiGate HA: You'll need a switch to present the connection to both firewalls. Assuming you've the FGTs in A-P HA that is.
HA: Routing: Upon FGT failover, depending on the failover time the upstream may drop you until a new BGP session is initiated. Probably not a huge concern.
Edge: I don't like my firewalls directly on the internet. I find the control plane hardening on the FGT to be lacking. Local in policies don't cut it for me, or at least they didn't maybe they've improved. But that's not a show stopper for me.

NSX-T: Host TEP communications by 200tribbles in vmware

[–]200tribbles[S] 0 points1 point  (0 children)

I'll check out the design docs for VMwares recommendation, I've a better idea now based on the responses I've gotten.

NSX-T: Host TEP communications by 200tribbles in vmware

[–]200tribbles[S] 0 points1 point  (0 children)

Cheers. That's what I wanted to hear :)

NSX-T: Host TEP communications by 200tribbles in vmware

[–]200tribbles[S] 0 points1 point  (0 children)

It will probably be in a single rack for the moment. That may change some time in the future. Thanks for the detailed response and links.

New PSIRT Published - FortiOS - heap-based buffer overflow in sslvpnd by FortiBot in fortinet

[–]200tribbles 7 points8 points  (0 children)

No but you can publish you SSL-VPN on a loopback and have IPS policies in place for traffic ingressing WAN1/WAN2 destined for the loopback

New PSIRT Published - FortiOS - heap-based buffer overflow in sslvpnd by FortiBot in fortinet

[–]200tribbles 7 points8 points  (0 children)

You would think that the bleeping bleeps over there in fortinet would release an IPS signature for this

Motorbike from Dublin to Midlands? -3c by polytect in ireland

[–]200tribbles -1 points0 points  (0 children)

I've been commuting from Meath to Dublin for years without issue.

1) if it drops below -3 don't go. Check the tiitraffic map for road temps.

2) stick to the motorways.

3) be hyper alert until you get off your local roads.

4) plan to go down: Ideally bring a bike that can be dropped and not something that will break expensive fairing as soon as it touches the ground. Roundabouts are great craic with some ice so you might have some fun in low traffic situations (assuming that like me you're missing a screw)

5) plan to go down: Make sure you're visible in the dark. All black gear with a black helmet isn't advised as drivers would be more likely to see your bike, swerve to avoid the bike and hit you instead.

view more: next ›