Questions tagged [firewall]

For questions about or relating to firewall operations, configuration and troubleshooting.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

What can be the cause of an icmp comming from a remote public IP reaching a private IP? [closed]

The context: I have the following simplified topology: Internet --- ISP Router --- Firewall --- ... The ISP router is a CGA2121 (cable modem with telephony), which is more or less a black box to me ...
Kraal's user avatar
  • 101
0 votes
1 answer
53 views

How to use 5 static ip addresses with virgin media broad band

I have installed virgin media business broadband and the package comes with 5 static ips. These IP are GRE tunnels from the HITRON router to virgin. the IP addresses are for example 66.66.66.65 - 66....
funkimunky's user avatar
0 votes
1 answer
69 views

Router to Wireless router (Packet Tracer)

Hi, Can anyone help why I can't ping from my pc in office network to my laptop in guest network or wireless network. It is possible to ping from guest network to office but failed vice versa. Main ...
eccentric learner's user avatar
0 votes
1 answer
41 views

How to prevent a user from using YouTube while connected to my network [closed]

i need to restrick specific user from using youtube and other socialmedia during job time
Kapala's user avatar
  • 1
0 votes
1 answer
75 views

Juniper SRX, workstation on SRX switch port cannot ping reth interface

I have a SRX345 firewall that has a workstation hanging off one of its ethernet ports. The workstation cannot ping the SRX reth interface, reth1.50 (its default gw) even though the ethernet port is ...
Jeff Todd's user avatar
0 votes
1 answer
57 views

DMZ cannot send traffic to INSIDE (Cisco ASA 5505)

Have a nice day, everyone. I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this: int vlan 3 no forward interface vlan 1 nameif dmz ...
Gekko's user avatar
  • 27
0 votes
1 answer
128 views

Why does pfSense require a DNS access list entry when all interfaces are selected?

Netgate 4100 v23.05-RELEASE The DNS Resolver was only working on LAN 1 but not LAN 3 (physical nics, not vlans). I added an access list rule as suggested here to grant LAN 3 access and now ...
user2864874's user avatar
0 votes
1 answer
41 views

Allow active connections in firewall on multiple BGP connected routers

We have a network on its own AS with 2 routers connected to 2 AS via BGP (full routes). The routers also both have a firewall on board that by default drops all traffic, except the one allowed. We ...
wimg's user avatar
  • 103
0 votes
1 answer
30 views

ACLs block connection

Here is my configuration on ISP router: interface GigabitEthernet0/0/0 no ip address duplex auto speed auto ! interface GigabitEthernet0/0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255....
Gekko's user avatar
  • 27
0 votes
0 answers
84 views

Use a single FortiSwitch in multiple, segmented networks

Is it possible to use a single switch in multiple, segmented and firewall protected subnets? Looking at the above picture, I have this existing network WITHOUT the two inner firewalls. The switch is ...
Shawn's user avatar
  • 1
1 vote
1 answer
139 views

Route traffic from firewall tunnel interface to server in Azure [closed]

On premise is a NAS that users access for file storage. Their AD server for authentication and GPO is in Azure. For remote users, they have a Remote Access VPN client in which they connect to the ...
Dacid Salin's user avatar
0 votes
0 answers
10 views

Trace Route RTO in two or more hop but next hop works [duplicate]

Today when I was doing tracert, in the 2nd & 3rd and also 4th Hop I get RTO but my next hop seems to be reachable. How come it works? Please answer asap.
VKG's user avatar
  • 1
0 votes
1 answer
89 views

How To get active vpn(site tot site) count from cisco FTD using ansible

I have been trying to get active VPN count from FTD firewalls using ansible, I tried the same on ASA and it have been running successfully. But when comes to FTD ansible, As it uses httpapi instead of ...
Eniyan's user avatar
  • 13
0 votes
2 answers
627 views

connect two private network using pfsense

I have two pfenses (say p1 and p2) in two separate networks. Each has a public IP. There is an internal network on each side (say n1 and n2). I want to connect these two networks through these two ...
horny hacker's user avatar
2 votes
4 answers
152 views

Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of ...
alex's user avatar
  • 157
1 vote
0 answers
566 views

Cannot access to Fortigate FW through mgmt port after forming HA

The two FW are Fortigate WiFi 60E, OS v7.2.0 build1157. The HA connection on the two FortiWifi60E was like PC1-----Fortigate FW1-----Fortigate FW2-----PC2 PC1 IP:192.168.1.100 PC1 default gateway:192....
jacky chong's user avatar
0 votes
1 answer
84 views

Blocking traffic means can't access that server?

I know this is a super newbie question. I recently learn about firewall and you would know there is security levels. The higher levels can send the traffic but cannot get it from the lower one. I am ...
Myung Seok Kang's user avatar
1 vote
1 answer
45 views

We want to see where the traffic is going on a Cisco 1140 firewall.. is there a way to do this? Need more than hitcounts [closed]

looking to see if there is a way to find out where traffic is going and coming from on a Cisco 1140 running FTD .... We need more than just a hit count...
Johnny 's user avatar
2 votes
1 answer
447 views

Cisco NGFW FTD NAT/PAT pool exhaustion monitoring

We have a customer, who rarely experiences NAT/PAT pool exhaustion on their Cisco Firepower NGFW 4110. While syslog will helpfully notify us that there's an immediate problem, we would really like to ...
Cow's user avatar
  • 1,732
3 votes
1 answer
81 views

Valid uses for IPv4 Options [Community-Wiki]

Engineers building firewall rules often block all IPv4 packets with IPv4 Options set in the header. However, there are a few common and valid use-cases for IPv4 Options. This Q&A is intended to ...
Mike Pennington's user avatar
0 votes
0 answers
26 views

Is it possible to create an IPS rule to Checkpoint 5200 PB-20 Firewall for Mysql packets

Is it possible to create an IPS rule to Checkpoint 5200 PB-20 Firewall that assesses the content from incoming packets for Mysql database server (port 3306)? If the packet is according to real Mysql ...
user3637971's user avatar
0 votes
1 answer
18 views

Is this possible? Adding a local device of my home network in client network without firewall configuration at client side (VPN?) [closed]

Let me explain what I want to achieve, but keep in mind that my networking knowledge is limited. I want to login at a clients network to do some remote troubleshooting. And I want to use (for example) ...
Dimitri's user avatar
4 votes
4 answers
2k views

Do I get any security benefits by NATing a network that's already behind a firewall?

I'm deploying a new network for IOT devices, this new network will be behind a firewall. I've been suggested to also get the network natted to further improve security. Does this really add any ...
Gaston539's user avatar
0 votes
1 answer
85 views

High availability vs network mac/arp config

Currently I test firewall HA settings and we observe some delays despite its active/passive config. Usually there should not be any interruption.Vendor explains this based on some configuration MAC/...
hakkican's user avatar
  • 145
0 votes
1 answer
57 views

Where are the GCP Firewall logs?

It's a little tricky to find GCP Firewall logs the first time you look for them. Where are they?
Mike Pennington's user avatar
1 vote
1 answer
311 views

Cisco ASA not accepting external traffic without NAT configuration

First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing. My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
adrianlzt's user avatar
  • 121
0 votes
1 answer
131 views

Routing VLANs to Firewall Ports

My network has 3 VLANs: 10, 11, 12, and their address spaces are 10.0.X.0/24 where X is the VLAN ID. Their default gateway is a virtualized pfSense (even though it's virtual, I will use terminology as ...
Jeremy's user avatar
  • 3
0 votes
1 answer
879 views

VLAN and firewall interconnection

I'm encountering some difficulties to connect some VLANs to a physical firewall. In details I have a core network with a L3 switch as a router and some L2 switches as access network. The network is ...
rouilleart's user avatar
0 votes
3 answers
176 views

Is it best practice to restrict access from non-DMZ hosts to DMZ hosts? [closed]

I know that access should be restricted from DMZ hosts to non-DMZ hosts where possible (i.e., my web servers should only be able to talk to other internal resources where necessary). But is it best ...
sfarbota's user avatar
  • 101
5 votes
3 answers
3k views

Difference between firewall and ACL

I have found many answers to this question, none of which satisfy me due to lack of detail. Can someone please explain in detail what is a firewall and what is its purpose, and what is an ACL and what ...
GalSuchetzky's user avatar
1 vote
4 answers
557 views

What is the difference between having a firewall inside vs outside the network?

I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow. The Question: What would the use case scenario be for firewall outside vs. ...
13months's user avatar
  • 131
0 votes
1 answer
543 views

TCP segment with flags ACK, PSH, URG

Can a TCP data segment with a 1 byte length have, at the same time, the flags ACK, PSH, URG set ? Is it conform or not to the TCP protocol ? Thank you.
fa7xtpy's user avatar
1 vote
1 answer
138 views

ARP cache in firewalls and difference from an end point device

Imagine a device A (192.168.32.5/24). Then two hosts, B and C, connected to the same interface (through a switch) having the same IP address (192.168.32.8/24) configured statically. No fancy tools/...
user2984629's user avatar
0 votes
1 answer
263 views

Inherent flaw in stateless firewalls?

I am but a lowly (software) developer dabbling with setting up a network in AWS and am having trouble understanding the fundamentals of stateless firewalls, or Network ACLs as they're also referred to ...
parmsib's user avatar
2 votes
1 answer
92 views

Which ranges of IPv6 and IPv4 do requests to the local network and the host?

I'm looking for the range of IP address that is bound to the local network or the host itself. So far for IPv4 I found: 10.0.0.0 - 10.255.255.255 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255....
Jimmy's user avatar
  • 23
1 vote
1 answer
66 views

Does a Transparent Firewall need a Default gateway if directly connected to a layer 3 device that is actively performing routing?

Good folks of the Network Engineering stack! I have a question that I assume most people could answer in their sleep. To better illustrate my question, I've provided a sketch of my network below. In ...
Jason's user avatar
  • 13
0 votes
1 answer
79 views

Gateway with multiple VLAN IPs on one NIC [closed]

I would like to separate several hosts from the local network and put them behind a firewall. I would like to use VLANs to "physically" separate them instead of using just different subnets. ...
user236012's user avatar
1 vote
0 answers
47 views

Pros and cons of directly interconnecting routers and firewalls vs via switch in an enterprise-network? [closed]

In a medium-sized enterprise network, let's say you have a pair of datacenter switches, a pair of distribution switches, a pair of internal core routers, a pair of firewalls, and a pair of edge ...
Steve Osmond's user avatar
3 votes
1 answer
307 views

Juniper SRX 340 route lookup failed

I've a strange issue on my Juniper; I've a policy to allow all traffic to a specific address behind it and, in effect, the policy works correctly. All the traffic I send reach the destination, except ...
Gianluca's user avatar
  • 361
1 vote
1 answer
551 views

Turning Off SPC card on Juniper SRX5800 series Firewall

We are running SRX5800 in a cluster. Each Node has FPCs as well as SPCs installed. Due to some maintenance downtime , we were required to power off FPCs as well as SPCs on a backup node , not in a ...
Nabeel's user avatar
  • 1,110
1 vote
0 answers
564 views

SOLVED: Check Point firewall log format through syslog [closed]

I receive logs from a series of Check Point firewalls that I don't manage and they are very thorough, containing every possible information about the communication. They're also formatted like field:&...
mfloris's user avatar
  • 195
-1 votes
1 answer
58 views

Holding session option in Fortiweb

I have Frotiweb installed as my WAF and it is connected to FrotiSandbox for behavioral detection. In the WAF' File Security Policy, I have the "Hold Session While Scanning" turned off and &...
Dan's user avatar
  • 1
1 vote
1 answer
323 views

NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?

Toplogy: Tool Used: Cisco Packet Tracer Scenario: NAT for hosts in any of the VLANs of Layer3-Switch not working. Ping requests reaches outside server, but NAT is not working so ISP Router can't ...
Rajan's user avatar
  • 121
0 votes
1 answer
1k views

How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]

Topology: How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network? In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
Rajan's user avatar
  • 121
0 votes
1 answer
139 views

Configure AAA on a router - Extended ACLs

How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
maggiejmyers1973's user avatar
0 votes
1 answer
44 views

How to force routing to https website without the IP

I am attempting to limit a group of Chromebooks to access one particular site for student testing. The issue is that the website is secure but the ssl cert is attached to the url not the ip. The ip of ...
Dorman D Kehr's user avatar
3 votes
1 answer
241 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
Alic Antunez Cruz's user avatar
0 votes
2 answers
2k views

EdgeRouter X select one out of two WANs according to target IP range

I am using IPSET to define the interested IP range. I want to direct packets to one out of two WAN connections according to an IP range. Here are my conditions. A specific IP range. It is defined by ...
Faust Neo's user avatar
1 vote
1 answer
65 views

Does UDP can be exposed to stateful analysis?

From protocol theory we know that TCP is stateful protocol. Different stateful packet filters do filtration based on connection state. I.e. it can distinguish responses and replies. It's obviously for ...
z0lupka's user avatar
  • 207
0 votes
0 answers
31 views

panic:integer divide fault Message Observed on SRX 5800 Routine Engine

We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
Nabeel's user avatar
  • 1,110

1
2 3 4 5
12