2

If I am sitting at the command line of a host and have an IP and port for a destination, is there any way to tell if the network path involves a firewall, or if it's being evaluated by a ruleset of some kind? I assume there's no way to tell because a network path that's not dropped (that's allowed by a firewall ruleset) would appear exactly the same as a network path with no firewall evaluation involved, but looking to confirm that.

Maybe more generally, is a firewall always involved (at some level) when I have multiple VLANs on my network, or could traffic route between VLANs (with different gateway IP addresses) without being evaluated by firewall rules?

I'm trying to determine how early to involve our InfoSec team in troubleshooting efforts when we lose connectivity - in some cases, we're crossing VLAN boundaries but the two different VLANs have open access to each other (all traffic allowed). Does this have to be configured by a firewall (and a ruleset), or is it possible that the switches can be configured to consider this traffic open (traversing VLAN without a firewall)?

Thanks!

Improve this question
2
  • What does your documentation for the network say? Can't you trace the path on your network diagrams?
    – Ron Maupin ♦
    Apr 14, 2016 at 11:41
  • Ideally, yes - I could review the documentation, assuming it's both up to date and clear to somebody who isn't a network engineer (both questionable). Really, I'm trying to figure out if there's an easy way to equip my non-networking team with the tools they need to troubleshoot - firewall changes are a common scapegoat and I'm trying to help clarify whether or not one is even involved, or if there are tell-tale indicators either way. It looks like there may be, but they're not going to be obvious to a non-network-engineer.
    – SqlRyan
    Apr 14, 2016 at 17:37

1 Answer 1

Reset to default
4

Traffic can be routed between VLANs by a router, there is no requirement for a firewall (which ultimately is really a router with some filtering features, anyway).

There is no way to say for sure whether you are crossing a firewall or other filtering mechanism on your network path. The best you can do is try to detect side effects of a firewall's presence, usually more because of its advanced security features than because of its ruleset. For example, if you capture traffic at either end, and the absolute TCP sequence numbers don't match, you probably have a firewall in between, rewriting them. Or if you have a session ending with a TCP RST, and that packet doesn't make it to the other side, it was probably dropped by a firewall. There are other effects that can be visible in various TCP/IP headers, but they are usually pretty subtle and more a clue than a definite sign a FW is present.

Improve this answer
1
  • Thanks - this answers my question by making it clear that there's no EASY way to know for sure by testing. We use the layout documentation where we can but it's not always clear and sometimes we're left to test and find the problem without help. Thanks for your assistance!
    – SqlRyan
    Apr 16, 2016 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.