Tech Check-In May 4, 2023 - Fortigate Config Revisions

• NWAEA Procircular Jun 12, 2023
• Fortigate Enable Config Revisions
  • Enables history of configuration changes made on the Fortigate. 
  • Accessable under the logged in username icon top right of the screen, Choose "Configuration" and "Revisions" to access
  • Once enabled Config files from different dates can be comaired.
  • Select 2 config files to compare, (Use Control/command to select) then click the "Diff" button
  • To enable this feature from the Fortigate Command Line:
    config system global
  set gui-allow-default-hostname enable
  set revision-backup-on-logout enable
end

• Option to use "Automation" to upload config to a SFTP or other server when config changes have been made and a user logs out of the Fortigate.
  • Backup Fortigate config  To SFTP share
    Fortigate > Security Fabric > Automation > New Stitch > Add Trigger > new Schedule > Action > CLI Script
    
    execute backup config sftp /FortiGate/Backup_%%date%%.conf SFTPSERVER  USERNAME PASSWORD
    
    Admin Profile Super_Admin 

• Only issue is the SFTP Details are exposed in the CLI script, I backup the share it dumps into and only use a special account that has access to a dedicated share.

Welcome everybody to the May. Fourth edition of Technology Check in thanks. Everyone for showing up today should have a pretty simple agenda today. It's all about whatever you guys want talk and then if I start babbling, know we'll be on that particular part it. Don't any vendors or anybody schedule So think only pieces is people who aren't signed it, but everyone here well aware instead response plan workshop we next Wednesday deadline $20 person we're providing food. And it's that, know. Basically, your school went pro circular, that's $10,000 value. We're paying circular 10 grand it'll valuable not sure offer it again. If can't make here. Then June seventeenth, Northwest Aa. there's something similar side So! Yeah, so kind what there. anyone anything about, I'll turn over you, Daniel. Anything cover today, questions add. No, guess just wrapping down end year. Here was hoping get some new macbooks this year, gonna hold off one more year will last these Adam 4 years already. going fifth Just down. really don't been working box. We discussed earlier. Nothing, nothing real exciting me right now. Okay, well, thanks update that. missed Foley. How you? Were second today? Not too much. kinda hopping Looking set up, snipe summer, getting started. Okay. You check-in process figured out You're checking Bro. Sorry check process. Well, so. We'll see works. Alrighty! Sounds good. Any? are done past? Yeah. What do past. checked in, spreadsheet, turns into giant mess. I'm there day week. ran like secretaries, write down, won't updated spreadsheet. now lot where discrepancies. when comes nightmare because doesn't match. oh! Got swapped mid Wow! Why, she's basically useless setup, everything there, keep date. It works But week someone said my asset Tag. One solve nice ones. probably look at this. got mine might too. they react or. metal. metal ones myself. Almost laptops. they've held good, After 5 years, though they're slowly warm. can still read them. better than us. Heyvery label, demo label. That's true. Alright, else, man. on. Mr. Shilling, how What's on? I've trying mess with net box, come away little bit frustration, lack terminal other things, otherwise starting prepare summer preparing distribution fall, ready one. supposed projects on, vendor mine, use brand e-rate. That Scott helped with, waiting notice 71, flagged questions. spin number, haven't gotten number from yet, project could peril ready. helping smaller Catholic schools area. Scott. way beginning June. Eea. whether pop through not, may A pokey so, doing 2 days worth help teacher champion knows macbook, designated school. stuff consider rudimentary. our extremely schools, them out, then, Scott, wanted remind again, did before recording Oh, okay. Yep. Yup, alright. ins. Remind last. Let me, parts There So, Sarah, what's information tech equipment Aa building bought. wasn't idea 5. concerned place totally put fiber know, even high across way. gotta figure out. sort keeping awake night. Trying else sit Zoom Meetings long, every training, infinite campus. role run have. hired data specialist who's actually program. be, back her up. I, able understand things. sitting which amazing, also gets overload, too, many things learn. integration has principal job am super excited about. replace him. disappointing. Some rest us pick slack. mean complain, reorganization, those he under radar no longer had he's gone anyway, everything's always nervous time August isn't yet. Sarah Kevin. Nothing much same old day. Stuff. Lot once. seems like, senior couple weeks. collecting devices and. did. Wanna ask guys. staff members start. They ability their ipads different classroom projectors. wondered used using. Or something, apple Tvs. Oh! Roku built interface theirs as far screen mirror. airplay something. it'd native, cheaper option. Sarah? sorry. Go ahead, Matt. say teams. I. while never moved direction, ways chrome doing, cast casting stuff. air teams nice. was. Air Okay? looking cheap solution. Maybe software based. didn't think, reflectors came across. any. Time ago, worked. mean, need experiment So. Yes, possible digging funny, 'cause 3 weeks left. me. deals. Here's dongle! easiest then. HDMI cables laptops, reflector work. works, either. Almost, yeah. goes computer. computer can. casting. ipad would go computer, projector project. computers connected projector? Our through. HD base T. runs the. The desk projector. plain cable. a, ended putting TV teacher's room. worked good issues work maybe test remember right. Have looked teams? yet either inexpensive central management console correctly. actually, few in. we've them, if, wanna show video Netflix error team blocked true Netflix, copyright by a. shouldn't do. don't. police device hook projector, smart displays. can't. to. direct connection. There's loophole around found. Like Google, settings system settings, disable. Gpu disable gpu want. Really? interesting. Seems easy fix you're suppose watch classroom. saying technology slant besides oh, sorry, expensive, yeah, mind cause room's document cameras. camera. very trick. bring topics talked far. Matt enough tug meeting subject brought group, will. try give ultimately phone call district with. About. cold Iowa, office Chief Information Office Oci Office. told another source outside received notification indicator compromise district's firewall, based security patch October supporting Fortunate engineers were calling latest firmware point time. serious expert bye-bye, basically, said, oio office. mostly first prove. Danny actual, Firewall confromised whole, whole an hour half. h. phone, additional h after. prove negative. evidence firewall compromised, Thank you. felt hopefully. prepared lesson lessons learned Ohio particularly, log files district. cloud blogging, turned firewall. service store. 7 logs cloud, affected Back October. kept asking Do from? least months ago. knew IP address. address from, unfortunately available logging was, is, configuration history list date upgraded firmware. To flaw, most schools. upgrade heard school, Hey? question say, version looks forensic standpoint important piece along have, changed. updates major changed At firewall? 40 gates backup. We'd backup folder. times changes. necessarily between anytime. update. had. January event finding, encourage under. gate, gate underneath administrators, accounts shown are. found created, fortunate support admin month VPN. legitimate. weren't. tracked back, were. unusual specific range, network. artifacts bot exploit verified access. It. Accounts create users, created suspect list, dark web buy. find firewalls compromised. monitoring servers, indication ever fire. take Use exploring maintain 6 research Normally, recommended hard drives drive, 48, 100, 101 F drive once default, retention period days, increasing enough, large fills capacity airs small, 75 80% disc utilization logs. option option, quickly. Is quarter product called Analyzer. virtual machine what? free license depending per sufficient provide matter Log retention, having network tie solution viable solution, machine, machines network, gladly setting physical build hypervisor setup for, documentation someplace here's version, ideally, policy changes add reason helpful branding investigations Did miss anything, Matt, by? covered started folks consult networking email notification. anytime logged somebody change, log, using Google folder structure throw clean. you'd record anyway. am, 48 user. peaked interest sounded similarities For users. running? Gonna be. 2. This weekend. at. spend Sunday hours adding notes Give pulling Hi'm 6, 4, 8, build, 1914. alright! 12. So? stare. Step steps. following path jump 7, talking 49 page, access let grab share link case K 12 glee.org click link. Live notes. live notes, There. You'll command left porting stupid enabled default engineer agree him commands username dropdown box there'll item says configuration. open sub menu that'll Revisions. without revision, each It? Would it? Stores makes copy Configurations separate revisions, Hey, difference versions updated, you'll running highly recommend chance, line well. failed. VPN logins, discovered I'd background radiation. getting, I's almost constantly Ssl. failed attempts made recommendation alert, off. Turned, best off, happen Once bunch invariably break seeing discerning. normal long strong passwords. factor authentication lookout fortunately says, security, apply fast takeaways standpoint. exactly belong beyond versus just, another. agency Ocr. contact ocio, Icn's somehow districts providers that? Had happen? remember? 7. 2, before. seventh string. That? what. look, upgraded, 3, fixed problem short amount breach announced happened Evidently assuming automate. bots shoot. Fred, search Internet drawn blank name. website. engine. Show port against below generate dump botnet exploit, they'll happily expected. Happened. widespread effort Let's let's available. hacking footprints touched firmware, 6. volnerable, 0 older vulnerable release patches supporting. group. fabrics, cli script Cli Sftp server, Bailey, Man, shared chat. awesome, scripting triggered Also, automation Ford does. sends also. Run, script, time, doesn't. daily Alrighty. hey, big, guess. Question, wise. worry. Approaching late? Does face Pocahontas, something? Sometime month. chance. office, pizza ranch meet together. do, continue regular since fine thinking? idea. consistency. upcoming Thursdays early. possibly 18, eighteenth choice suppose, 20 fifth, busy quick policy. mayeenth end. Pocahontas enjoying wonderful weather Alright! May fourth