Skip to content
Kandaro
Start free trial

Decoy · Device

FortiGate firewall decoy

Firewalls are some of the most attacked devices there are, and FortiGate exploits are widely used. This decoy poses as FGT-CORE01, a FortiGate-100F running FortiOS 7.4, with its management page, SSL-VPN paths, SSH, Telnet and SNMP.

Start free trialAll decoys

What it emulates

Poses as: Fortinet FortiGate firewall.

It answers the paths that known exploits probe, such as the management API bypass and the SSL-VPN bugs, so you see who is testing them.

  • HTTPS admin 443

    The FortiGate sign-in page over HTTPS. Records every username and password, and every probe of known management and SSL-VPN exploit paths.

  • HTTP admin 80

    The same page over plain HTTP.

  • SSH 22

    Records every username, password and key fingerprint tried, then refuses them. Disconnects after six tries.

  • Telnet 23

    Shows the FortiGate-100F banner and login prompt, records every username and password, then refuses.

  • SNMP 161/udp

    Answers basic SNMP read queries and records the community string, which works like a password. Replies are capped per address so it cannot be used to flood anyone.

What it catches

Every touch, explained in plain English.

Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.

  • Logins to the firewall management page, SSH and Telnet
  • Probes for known FortiOS exploits, such as the management API bypass and SSL-VPN bugs
  • SNMP queries with guessed community strings
  • Port scans across the management network

MITRE ATT&CK

Techniques come from a fixed table, not from AI, so the same activity always maps the same way.

  • T1046Network Service Discovery
  • T1059Command and Scripting Interpreter
  • T1110Brute Force
  • T1190Exploit Public-Facing Application
  • T1552.001Unsecured Credentials: Credentials In Files
  • T1552.005Unsecured Credentials: Cloud Instance Metadata API

Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC

Safe by design

Built to be attacked. Never a way in.

A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.

  • It runs nothing

    The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.

  • It connects to one place only

    Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.

  • Kandaro can only send it settings

    Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.

  • It holds no real secrets

    Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.

  • It cannot be used to attack others

    It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.

Non-root, read-only container with signed images. How we secure sensors

Where to put it

Place it where an intruder will look.

Put it in your management VLAN, or wherever an intruder inside would look for the firewall admin page.

Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys

FAQ

FortiGate firewall decoy questions

Does it replace my real firewall?
No. It only looks like a FortiGate. It filters nothing and forwards nothing; it exists to be found.
Can an attacker actually log in?
No. Every real username and password is refused. Only a password Kandaro planted as bait opens a fake shell, and even there nothing runs: every command gets made-up output.
Is it safe to run on my network?
Yes. A decoy only answers connections with fake data. It runs nothing, forwards nothing and only connects out to the Kandaro API over HTTPS. It runs as an unprivileged, read-only container.

Related decoys

Pair it with these.

Put this decoy on your network today.

Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.

Start free trialView packages

Card required · cancel before day 14 and pay nothing