Retrieving Config Files from WatchGuard Firewalls

You will need to connect to your WatchGuard firewall using the WatchGuard System Manager software that came with your firewall (you can also download this software using your WatchGuard support login).

The procedure for getting the configuration from the device using WatchGuard System Manager is as follows:

1. Run WatchGuard System Manager.
2. Connect to your firewall device and logon.
3. From the "Tools" menu select "Policy Manager".
4. Inside Policy Manager, select from the "File" menu "Save" and then "As File...". This will enable you to save your configuration as a file that can be used with Nipper Studio.

McAfee Firewall Backup Script- Free Tool to Restore Firewall Configuration

McAfee / Secure Computing Firewall (Sidewinder) Backup Script (MFBS) enables you to quickly create a script that can be used to restore your firewall configuration. Older SecureOS versions enabled you to backup the configuration to an XML file, however recent versions create encrypted archives. This prevents you from manually modifying, scripting changes or any other analysis.

To download this free tool go to www.titania-security.com/labs/mfbs

Requirements

All you need is the ability to copy files to and from your firewall, plus the ability to run scripts. There are multiple ways that you can do this, but you could use the edit file facility in the management software.

Running

Download and transfer the script to your firewall and then logon to the command line interface. You can execute the script using the following commands:

• srole (to perform administration tasks)
• ./mcafee-backup-v1.3.script (to execute the script)

You then simply transfer the "firewall.config" file to a secure location, this is your backup. It is worth noting that the system will replace some passwords during this, so you may want to edit those specific lines.

License

Copyright Titania Ltd 2009. You are free to copy and distribute this script. If you make modifications to the script, these must be sent back to Titania for integration and potentially made available within future publicly available releases.

To download this tool for free go to www.titania-security.com/labs/mfbs

Network Security Auditing Tool- Free Trial Available

Nipper Studio Network Security Auditing Tool

Free trial at www.titania-security.com

Nipper Studio is a security auditing software that allows its users to produce detailed security reports on the vulnerabilities in their network devices (switches, routers, firewalls etc.) Nipper Studio works from the inside out by analysing the actual devices configurations, giving you a much more detailed report than a vulnerability scanner could produce. Furthermore the software never touches the network so Nipper Studio can be used in high security environments. A report at the level of a manual penetration tester is generated within seconds and displays:

• Severity of the threat
• Ease of resolution
• Potential solutions to resolve the issue

(you can use either the CVSSv2 rating system or the established Nipper Studio Rating System and export results into various formats)

Nipper Studio also produces a mitigation report that provides the information to help organisations fix their network vulnerabilities with the smallest impact on their operations. When the fixes are made Nipper Studio can generate a comparison report that displays what changes have been made and how successful this has been in securing their networks.

Customizable settings include:

1. The ability to theme your report throughout with your own company branding;

2. Choose policy settings that are relevant to your organization and construct profiles that remember these settings;

3. Wholly or partly exclude sections and findings in the report. You can also hide sensitive information from the report;

4. Add your own notes to the report;

Nipper Studio is multi-platform and supports an extensive amount of devices, for a full supported device list go to www.titania-security.com/nipperstudio/devices 

For a free evaluation of the software go to www.titania-security.com

Retrieving 3Com SuperStack 3 Configuration Files

We would recommend using HTTPS rather than HTTP for transferring your devices configuration as the latter provides no encryption. The procedure for getting the configuration from the device using HTTP(S) is as follows:

1. Using your favorite web browser, connect to the HTTP(S) service provided by your 3Com SuperStack 3 firewall for remote management. You can do this by entering "https://" (recommended) or "http://" followed by your devices IP address.
2. Logon using your administration username and password. 3Com SuperStack 3 firewalls default to using "admin" for the username and "password" for the password.
3. Select from the menu on the right; "Tools".
4. Select the "Configuration" tab at the top.
5. Click the "Export" button and follow the instructions to save the device configuration to a file.

Retrieving Config Files From Cyberguard / Secure Computing Firewalls (SecureOS 6)

The configuration can easily be obtained from SecureOS 6 firewalls, but it is not directly usable in the form extracted from the firewall. This section details how to obtain the configuration from a SecureOS 6 firewall.

To obtain the XML configuration file usable by Nipper Studio, follow the procedure below:

1. Log into the web-based administration interface on your SecureOS 6 devices.
2. Click on the "Control" option from the menu bar.
3. Click on the "Firewall" menu and select the "Save Configuration" option. This will save the configuration into a .jar file on your system.
4. You will need to extract the .jar file which is an archive similar to a .zip file. The 7-zip tool (http://www.7-zip.org) under Windows can be used to extract the files. Similar tools exist on other platforms.
5. Inside the .jar file is a "Config.tar" file, another file archive. This too can be extracted using the 7-zip tool under Windows or a tar command.
6. Inside the .tar file is the "FwConfig.xml" configuration file to use with Nipper Studio.

Extracting Config Files from Juniper NetScreen, SSG And ISG Firewalls (ScreenOS)

There are several different methods of extracting the configuration from from your Juniper NetScreen device and this guide outlines three different methods.

Using HTTP(S)

We would recommend using HTTPS rather than HTTP for transferring your devices configuration as the latter provides no encryption. The procedure for getting the configuration from the device using HTTP(S) is as follows:

1. Using your favorite web browser, connect to the HTTP(S) service provided by your Juniper NetScreen device for remote management. You can do this by entering "https://" (recommended) or "http://" followed by your devices IP address.
2. Logon using your administration username and password. Juniper NetScreen devices default to using "netscreen" for the username and password.
3. Select from the menu on the right; "Configuration", then "Update" and finally "Config File".
4. Click the "Save To File" button to save the configuration to a local file.

Using SSH, Telnet Or The Console

For this procedure you will be using the Command Line Interface (CLI) of your Juniper NetScreen device using an SSH client (such as OpenSSH or Putty), Telnet or through the console port. We would recommend using either SSH (for remote connections) or using a direct connection to the console port. Telnet provides no encryption of the communications and therefore your authentication credentials and configuration would be vulnerable if a malicious user were to monitor your connection.

1. Connect to the Juniper NetScreen using your favorite SSH client, Telnet or a direct console connection.
2. Logon using your administration authentication credentials.
3. Execute the following CLI command and capture the output (possibly using the cut and paste facility):

   get config all

4. Save the captured output to a file and remove any visible page lines (i.e. --More--).

Using TFTP

We have included TFTP in order to be complete, but we don't recommend using this method for two reasons:

1. it provides no authentication;
2. it provides no encryption of the network communications.

However, if you want to make use of TFTP to transfer the configuration from your NetScreen device then the procedure is as follows:

1. Connect to the Juniper device using SSH, Telnet, ASDM, PDM or through a Console connection.
2. Login.
3. Transfer the configuration using the TFTP command:

   save config to tftp <ip-address>:<filename> from interface <interface>

Retrieving Config Files from Cyberguard / Secure Computing Firewalls (SecureOS 6)

The configuration can easily be obtained from SecureOS 6 firewalls, but it is not directly usable in the form extracted from the firewall. This section details how to obtain the configuration from a SecureOS 6 firewall.

To obtain the XML configuration file usable by Nipper Studio, follow the procedure below:

1. Log into the web-based administration interface on your SecureOS 6 devices.
2. Click on the "Control" option from the menu bar.
3. Click on the "Firewall" menu and select the "Save Configuration" option. This will save the configuration into a .jar file on your system.
4. You will need to extract the .jar file which is an archive similar to a .zip file. The 7-zip tool (http://www.7-zip.org) under Windows can be used to extract the files. Similar tools exist on other platforms.
5. Inside the .jar file is a "Config.tar" file, another file archive. This too can be extracted using the 7-zip tool under Windows or a tar command.
6. Inside the .tar file is the "FwConfig.xml" configuration file to use with Nipper Studio.