Wifi WPA2 is vunerable to KRACK. FortiAP's firmware upgrade steps

[adogra]

Hi Guys, 

We all probably know that Wifi WPA2 is vulnerable to KRACK  

https://www.darkreading.com/attacks-breaches/secure-wifi-hijacked-by-krack-vulns-in-wpa2-/d/d-id/133...

https://www.darkreading.com/attacks-breaches/secure-wifi-hijacked-by-krack-vulns-in-wpa2-/d/d-id/133...

http://fortiguard.com/psirt/FG-IR-17-196

FortiAP's latest firmware solves this vulnerability in firmware 5.6.1:  https://forum.fortinet.com/tm.aspx?m=153352

I need to upgrade all FortiAP's  to latest firmware.  I have  upgrade doc for FortiAP's as well http://docs.fortinet.com/uploaded/files/3961/fortiap-v5.6.1-release-notes.pdf. It doesn't say about compatibility between Fortigate Firewall & FortiAP's OS?

My question are:

a) Do I need to upgrade Fortigate firmware/ FortiOS first before I upgrade FortiAP's connected to it?. Is there any issue if Fortigate Firewall firmware is older than FortiAP's firmware.

b)  Any pointer like step by step guide for this upgrade?

c) Is there any consideration before upgrade of FortiAP's like BIOS upgrade too?

d) How to check/verify is it mesh leaf/topology

Thanks very much

[Toshi_Esumi · Accepted solution]

Looks like they broke down the description at the FortiGuard page to be easier to read than the original version I read yesterday. My interpretation of yesterdays version was if APs are not mesh leaf none of these applies to them. So I decided not to upgrade at this moment because AP firmware 5.6.1 requires FortiOS 5.6.1 or above(5.6.2 is the latest) according to the AP 5.6.1 release notes you saw (page 7).

In my understanding for mesh to work is to have an interface "wl.mesh" with "set type wl-mesh" on the controller FG/FWF. Or check "config wireless-controller wtp" then if any of them have a mesh SSID/vap is applied. You can find a mesh vap with "set mesh-backhaul ena". 

I actually open a TAC TT to verify the upgrade procedure yesterday although I decided not to. Just upgrade FG/FWF to 5.6.x then follow the upgrade path by checking FortiAP's release notes starting from 5.6.1 backwards; 5.6.1RN says upgrade from 5.6.0, then check 5.6.0RN, and so on and on until you can reach the current version.

[heisenberg · Accepted solution]

Hi,

the Key Reinstallation Attacks are client side kind of threat, so if you don't use your AP's as repeater (or you use it with a mesh configuration, that you have been set-up with a particular procedure, so they can speak over wifi themselves) you have not to patch it.

Generally speaking until OS patches (client) will not be released it will be better to use vpn's, ssl and encrypted traffic for WiFi connected devices.

[Toshi_Esumi · Accepted solution]

Looks like they broke down the description at the FortiGuard page to be easier to read than the original version I read yesterday. My interpretation of yesterdays version was if APs are not mesh leaf none of these applies to them. So I decided not to upgrade at this moment because AP firmware 5.6.1 requires FortiOS 5.6.1 or above(5.6.2 is the latest) according to the AP 5.6.1 release notes you saw (page 7).

In my understanding for mesh to work is to have an interface "wl.mesh" with "set type wl-mesh" on the controller FG/FWF. Or check "config wireless-controller wtp" then if any of them have a mesh SSID/vap is applied. You can find a mesh vap with "set mesh-backhaul ena". 

I actually open a TAC TT to verify the upgrade procedure yesterday although I decided not to. Just upgrade FG/FWF to 5.6.x then follow the upgrade path by checking FortiAP's release notes starting from 5.6.1 backwards; 5.6.1RN says upgrade from 5.6.0, then check 5.6.0RN, and so on and on until you can reach the current version.

[adogra]

Thanks Toshi. So it doesn't have any impact on Fortigate running on 5.4.3 version.  Seems like these Fortigate still impacted by these CVE's  "All other CVEs (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081) affect FortiGates running the following versions"  except CVE-2017-13082. according to: http://fortiguard.com/psirt/FG-IR-17-196

cheers

[Toshi_Esumi]

Don't forget that the section is under the overall condition of the sentence at the beginning:

  "1. FortiGate:   Those issues may only affect FortiGate Wifi models used under Wifi Client mode. Specifically:"   They are affected only if it's FortiWifi with "FWF as a client" set up. Those are only for WiFi client side and "FWF as a client" operate as a client. We used to have one customer with this set up but it was temporary and we migrated them to a wired internet connection last year then wifi was re-purposed for guest wifi.

[adogra]

Great. thanks for your help. So only Wifi AP's and clients are affected with this vulnerability KRACK. we have FTG firewall as well as FortiAP's in non mesh topology/mode.  All AP's are individually connected to Ethernet. Hence we are unaffected from this vulnerability. 

PS: pls correct me. If I'm wrong.

thanks very much

[heisenberg · Accepted solution]

yes, you are not affected from Fortigate point of view...you are still affected if you use unpatched(very affected) android and linux devices, (kind of less affected) if you use windows devices.

Currently either linux and windows has released patches so you only have to apply it.

For android devices unless you use google phones the story will be much different...unfortunately

hope this helps

[Spidler]

So, I'm guessing if we've got a site full of 223B's that we're kind of screwed, yes? I don't see anything past build 0363...

[tanr]

Note that Fortinet has still not provided a patch for any of the 5.4.x FAPs as well (320C, 221C, etc.).  So any of us who have to run a guest network off them and can't force our users to patch their phones are at risk.

I opened a ticket to check on this and was told the patch should come out around the first week of November.

This is in pretty stark contrast to Aruba, who released a patch the same day as the Krack announcement.  Since the researchers who found the vulnerability supposedly reported it to all the major OS and network security companies back in July or August this really looks like Fortinet dropped the ball on this one.

[heisenberg · Accepted solution]

Hi,

the Key Reinstallation Attacks are client side kind of threat, so if you don't use your AP's as repeater (or you use it with a mesh configuration, that you have been set-up with a particular procedure, so they can speak over wifi themselves) you have not to patch it.

Generally speaking until OS patches (client) will not be released it will be better to use vpn's, ssl and encrypted traffic for WiFi connected devices.