1

Here is the network topology that I have:

Private network 1 --> IPFire Firewall 1 <---> IPFire Firewall 2 <-- Private network 2

I can ping from private network 1 to private network 2, that is after creating an IPsec tunnel between the two IPFire devices.

What I want to do is to have a middle device between the two IPFire devices, the network topology is like this:

Private network 1 --> IPFire Firewall 1 <-- middle device --> IPFire Firewall 2 <-- Private network 2

I want to use this middle device as a packet sniffer for the packets flawing between IPFire 1 and 2. What I don't know is how transfer the connection from one interface of the middle device to the second, the IPsec tunnel uses private IPs, so I don't know who the middle device will affect the tunnel establishment.

2

To easily see the traffic in it's encrypted state between the two firewalls which you own and manage. I suggest a hub. It requires no configuration, you simply plug in both firewall's outside interfaces and then plug in your laptop with monitoring tools (may need to adjust NIC settings/promiscuous etc) to see all the traffic flowing between the two devices.

19
  • 1. The middle device could be a laptop or one-board computer on which a Linux distribution is installed, although, I didn't figure out how to install the OS on the one-board computer I have, I have An ALIX board series 6 board. In the case of the laptop we will have to use the switch, right? 2. I want to see all the types of packets flawing between the IPsec devices. – Mohamed Ahmed Jun 18 '14 at 15:28
  • In this case then you won't be able to from the 'middle', but just as good, you can set your device up just off the inside interface of your firewalls and get the same effect. If your firewalls support SPAN and you have enough ports for it you can mirror that way, otherwise as user5469 said you could introduce a switch or a tap right on the inside of the firewall to mirror/SPAN to your laptop. – A L Jun 18 '14 at 15:44
  • As we continue to clarify I'll edit my actual answer so it's helpful/relevant/clear for future viewers. – A L Jun 18 '14 at 15:45
  • The switch seems to be a good solution, I think. The topology is like net1>>IPFire1>>Switch>>IPFire2>>net2. I will connect the laptop to the switch, right? I don't actually know how to do port mirroring. And I really would like to apply this solution on virtualbox first! I don't know how to simulate a switch? – Mohamed Ahmed Jun 18 '14 at 15:55
  • What you're listing here won't work, because (at least in your first post) - the two networks have an IPsec tunnel between them. So doing it the way you propose you'll get packets, but they'll all be encrypted and you won't be able to glean anything from your captures. – A L Jun 18 '14 at 16:04
0

I've never done this exactly, but my understanding is that you would want some sort of physical splitter in between to capture traffic to a 3rd (middle) device. Would depend on the type of physical layer1 connection. See link for an example of network tap solutions http://www.flukenetworks.com/enterprise-network/network-monitoring/Tap-Solutions

0

You could also put a switch in the middle and connect the sniffer to a mirror port. This will add another device to your setup but no special configuration will be needed on the sniffer.

2
  • Your suggestion seems promising, however I don't know much about how to configure this mirror port and how to connect it to the sniffer. – Mohamed Ahmed Jun 18 '14 at 15:34
  • Basically you will have to connect the two firewalls to the switch on the same VLAN. Then connect the sniffer to another port and configure it as a mirror. The exact commands ton configure a mirror port depends on the switch model. In cisco it will look like: Switch# configure terminal Switch# monitor session 1 source interface fastethernet 0/1 Switch# monitor session 1 destination interface fastethernet 0/3 – user5469 Jun 18 '14 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.