Mailing List Archive

fortigate 100E hourly changes not filtered
Hi All,

Having a problem with Rancid 3.9 with Fortigate 100E firewall. Each hour, the config is updated with new Virus files and it is triggering an update/email for the change.

Here is the delta:


@@ -1,12 +1,12 @@

#RANCID-CONTENT-TYPE: fortigate

#

#Version: FortiGate-100E v6.2.3,build1066,191218 (GA)

- #Virus-DB: 77.00033(2020-04-28 08:20)

- #Extended DB: 77.00033(2020-04-28 08:20)

- #IPS-DB: 15.00828(2020-04-25 01:28)

+ #Virus-DB: 77.00035(2020-04-28 10:20)

+ #Extended DB: 77.00035(2020-04-28 10:20)

+ #IPS-DB: 15.00829(2020-04-28 00:39)

#IPS-ETDB: 0.00000(2001-01-01 00:00)

- #APP-DB: 15.00828(2020-04-25 01:28)

+ #APP-DB: 15.00829(2020-04-28 00:39)

#INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)

#Serial-Number: FG100ETK19022626

#IPS Malicious URL Database: 2.00627(2020-04-28 05:33)

#Botnet DB: 1.00000(2012-05-28 22:51)





I can see in the lib/fortigate.pm file where it tries to filter this out, but it still showing up. Has anyone else seen this?



Thanks for a really useful product, it has saved us on a number of occasions.



Tim

This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify so to the sender by e-mail and delete the original message. In such cases, please notify us immediately at info@infinite.com . Further, you are not to copy, disclose, or distribute this e-mail or its contents to any unauthorized person(s). Any such actions are considered unlawful. This e-mail may contain viruses. Infinite has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachments. Infinite reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infinite e-mail system.



***INFINITE******** End of Disclaimer********INFINITE********
Re: fortigate 100E hourly changes not filtered [ In reply to ]
Tue, Apr 28, 2020 at 08:24:01PM +0000, Tim McIntire:
> Hi All,
>
> Having a problem with Rancid 3.9 with Fortigate 100E firewall. Each hour, the config is updated with new Virus files and it is triggering an update/email for the change.
>
> Here is the delta:
>
> @@ -1,12 +1,12 @@
>
> #RANCID-CONTENT-TYPE: fortigate
> #
> #Version: FortiGate-100E v6.2.3,build1066,191218 (GA)
> - #Virus-DB: 77.00033(2020-04-28 08:20)
> - #Extended DB: 77.00033(2020-04-28 08:20)
> - #IPS-DB: 15.00828(2020-04-25 01:28)
> + #Virus-DB: 77.00035(2020-04-28 10:20)
> + #Extended DB: 77.00035(2020-04-28 10:20)
> + #IPS-DB: 15.00829(2020-04-28 00:39)
> #IPS-ETDB: 0.00000(2001-01-01 00:00)
> - #APP-DB: 15.00828(2020-04-25 01:28)
> + #APP-DB: 15.00829(2020-04-28 00:39)
> #INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
> #Serial-Number: FG100ETK19022626
> #IPS Malicious URL Database: 2.00627(2020-04-28 05:33)
> #Botnet DB: 1.00000(2012-05-28 22:51)
>
> I can see in the lib/fortigate.pm file where it tries to filter this out, but it still showing up. Has anyone else seen this?
>
> Thanks for a really useful product, it has saved us on a number of occasions.

rancid.conf:FILTER_OSC=ALL (or in <group>/rancid.conf) must be set to filter
these. It defaults to YES. Also see rancid.conf(5).

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss@www.shrubbery.net
https://www.shrubbery.net/mailman/listinfo/rancid-discuss
Re: fortigate 100E hourly changes not filtered [ In reply to ]
Thanks John.. that clears it up.

Tim

-----Original Message-----
From: john heasley [mailto:heas@shrubbery.net]
Sent: Tuesday, April 28, 2020 3:29 PM
To: Tim McIntire <Tim.McIntire@infinite.com>
Cc: Rancid-discuss@www.shrubbery.net
Subject: Re: [rancid] fortigate 100E hourly changes not filtered

Tue, Apr 28, 2020 at 08:24:01PM +0000, Tim McIntire:
> Hi All,
>
> Having a problem with Rancid 3.9 with Fortigate 100E firewall. Each hour, the config is updated with new Virus files and it is triggering an update/email for the change.
>
> Here is the delta:
>
> @@ -1,12 +1,12 @@
>
> #RANCID-CONTENT-TYPE: fortigate
> #
> #Version: FortiGate-100E v6.2.3,build1066,191218 (GA)
> - #Virus-DB: 77.00033(2020-04-28 08:20)
> - #Extended DB: 77.00033(2020-04-28 08:20)
> - #IPS-DB: 15.00828(2020-04-25 01:28)
> + #Virus-DB: 77.00035(2020-04-28 10:20) #Extended DB:
> + 77.00035(2020-04-28 10:20)
> + #IPS-DB: 15.00829(2020-04-28 00:39)
> #IPS-ETDB: 0.00000(2001-01-01 00:00)
> - #APP-DB: 15.00828(2020-04-25 01:28)
> + #APP-DB: 15.00829(2020-04-28 00:39)
> #INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
> #Serial-Number: FG100ETK19022626
> #IPS Malicious URL Database: 2.00627(2020-04-28 05:33)
> #Botnet DB: 1.00000(2012-05-28 22:51)
>
> I can see in the lib/fortigate.pm file where it tries to filter this out, but it still showing up. Has anyone else seen this?
>
> Thanks for a really useful product, it has saved us on a number of occasions.

rancid.conf:FILTER_OSC=ALL (or in <group>/rancid.conf) must be set to filter these. It defaults to YES. Also see rancid.conf(5).
This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify so to the sender by e-mail and delete the original message. In such cases, please notify us immediately at info@infinite.com . Further, you are not to copy, disclose, or distribute this e-mail or its contents to any unauthorized person(s). Any such actions are considered unlawful. This e-mail may contain viruses. Infinite has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachments. Infinite reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infinite e-mail system.



***INFINITE******** End of Disclaimer********INFINITE********

_______________________________________________
Rancid-discuss mailing list
Rancid-discuss@www.shrubbery.net
https://www.shrubbery.net/mailman/listinfo/rancid-discuss