Skip to main content
adogra
adogra
New Member
October 17, 2017
Solved

Wifi WPA2 is vunerable to KRACK. FortiAP's firmware upgrade steps

  • October 17, 2017
  • 8 replies
  • 12487 views

Hi Guys, 

We all probably know that Wifi WPA2 is vulnerable to KRACK  

https://www.darkreading.com/attacks-breaches/secure-wifi-hijacked-by-krack-vulns-in-wpa2-/d/d-id/133...

https://www.darkreading.com/attacks-breaches/secure-wifi-hijacked-by-krack-vulns-in-wpa2-/d/d-id/133...

http://fortiguard.com/psirt/FG-IR-17-196

FortiAP's latest firmware solves this vulnerability in firmware 5.6.1:  https://forum.fortinet.com/tm.aspx?m=153352

I need to upgrade all FortiAP's  to latest firmware.  I have  upgrade doc for FortiAP's as well http://docs.fortinet.com/uploaded/files/3961/fortiap-v5.6.1-release-notes.pdf. It doesn't say about compatibility between Fortigate Firewall & FortiAP's OS?

 

My question are:

a) Do I need to upgrade Fortigate firmware/ FortiOS first before I upgrade FortiAP's connected to it?. Is there any issue if Fortigate Firewall firmware is older than FortiAP's firmware.

 

b)  Any pointer like step by step guide for this upgrade?

 

c) Is there any consideration before upgrade of FortiAP's like BIOS upgrade too?

 

d) How to check/verify is it mesh leaf/topology

 

Thanks very much

    Best answer by Toshi_Esumi

    Looks like they broke down the description at the FortiGuard page to be easier to read than the original version I read yesterday. My interpretation of yesterdays version was if APs are not mesh leaf none of these applies to them. So I decided not to upgrade at this moment because AP firmware 5.6.1 requires FortiOS 5.6.1 or above(5.6.2 is the latest) according to the AP 5.6.1 release notes you saw (page 7).

    In my understanding for mesh to work is to have an interface "wl.mesh" with "set type wl-mesh" on the controller FG/FWF. Or check "config wireless-controller wtp" then if any of them have a mesh SSID/vap is applied. You can find a mesh vap with "set mesh-backhaul ena". 

    I actually open a TAC TT to verify the upgrade procedure yesterday although I decided not to. Just upgrade FG/FWF to 5.6.x then follow the upgrade path by checking FortiAP's release notes starting from 5.6.1 backwards; 5.6.1RN says upgrade from 5.6.0, then check 5.6.0RN, and so on and on until you can reach the current version.

     

    8 replies

    Toshi_Esumi
    SuperUser
    Toshi_EsumiAnswer
    SuperUser
    October 17, 2017

    Looks like they broke down the description at the FortiGuard page to be easier to read than the original version I read yesterday. My interpretation of yesterdays version was if APs are not mesh leaf none of these applies to them. So I decided not to upgrade at this moment because AP firmware 5.6.1 requires FortiOS 5.6.1 or above(5.6.2 is the latest) according to the AP 5.6.1 release notes you saw (page 7).

    In my understanding for mesh to work is to have an interface "wl.mesh" with "set type wl-mesh" on the controller FG/FWF. Or check "config wireless-controller wtp" then if any of them have a mesh SSID/vap is applied. You can find a mesh vap with "set mesh-backhaul ena". 

    I actually open a TAC TT to verify the upgrade procedure yesterday although I decided not to. Just upgrade FG/FWF to 5.6.x then follow the upgrade path by checking FortiAP's release notes starting from 5.6.1 backwards; 5.6.1RN says upgrade from 5.6.0, then check 5.6.0RN, and so on and on until you can reach the current version.

     

    adogra
    adograAuthor
    New Member
    October 18, 2017

    Thanks Toshi. So it doesn't have any impact on Fortigate running on 5.4.3 version.  Seems like these Fortigate still impacted by these CVE's  "All other CVEs (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081) affect FortiGates running the following versions"  except CVE-2017-13082. according to: http://fortiguard.com/psirt/FG-IR-17-196

     

    cheers

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 18, 2017

    Don't forget that the section is under the overall condition of the sentence at the beginning:

      "1. FortiGate:   Those issues may only affect FortiGate Wifi models used under Wifi Client mode. Specifically:"   They are affected only if it's FortiWifi with "FWF as a client" set up. Those are only for WiFi client side and "FWF as a client" operate as a client. We used to have one customer with this set up but it was temporary and we migrated them to a wired internet connection last year then wifi was re-purposed for guest wifi.
    heisenberg
    heisenberg
    New Member
    October 19, 2017

    Hi,

    the Key Reinstallation Attacks are client side kind of threat, so if you don't use your AP's as repeater (or you use it with a mesh configuration, that you have been set-up with a particular procedure, so they can speak over wifi themselves) you have not to patch it.

     

    Generally speaking until OS patches (client) will not be released it will be better to use vpn's, ssl and encrypted traffic for WiFi connected devices.

     

     

    Terms & ConditionsAccessibility statement
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT