Questions tagged [firewall]
For questions about or relating to firewall operations, configuration and troubleshooting.
594
questions
0
votes
0
answers
16
views
What can be the cause of an icmp comming from a remote public IP reaching a private IP? [closed]
The context:
I have the following simplified topology:
Internet --- ISP Router --- Firewall --- ...
The ISP router is a CGA2121 (cable modem with telephony), which is more or less a black box to me ...
- 101
0
votes
1
answer
53
views
How to use 5 static ip addresses with virgin media broad band
I have installed virgin media business broadband and the package comes with 5 static ips. These IP are GRE tunnels from the HITRON router to virgin.
the IP addresses are for example
66.66.66.65 - 66....
0
votes
1
answer
69
views
Router to Wireless router (Packet Tracer)
Hi, Can anyone help why I can't ping from my pc in office network to my laptop in guest network or wireless network. It is possible to ping from guest network to office but failed vice versa.
Main ...
0
votes
1
answer
41
views
How to prevent a user from using YouTube while connected to my network [closed]
i need to restrick specific user from using youtube and other socialmedia during job time
- 1
0
votes
1
answer
75
views
Juniper SRX, workstation on SRX switch port cannot ping reth interface
I have a SRX345 firewall that has a workstation hanging off one of its ethernet ports.
The workstation cannot ping the SRX reth interface, reth1.50 (its default gw) even though the ethernet port is ...
0
votes
1
answer
57
views
DMZ cannot send traffic to INSIDE (Cisco ASA 5505)
Have a nice day, everyone.
I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this:
int vlan 3
no forward interface vlan 1
nameif dmz
...
- 27
0
votes
1
answer
128
views
Why does pfSense require a DNS access list entry when all interfaces are selected?
Netgate 4100
v23.05-RELEASE
The DNS Resolver was only working on LAN 1 but not LAN 3 (physical nics, not vlans). I added an access list rule as suggested here to grant LAN 3 access and now ...
- 101
0
votes
1
answer
41
views
Allow active connections in firewall on multiple BGP connected routers
We have a network on its own AS with 2 routers connected to 2 AS via BGP (full routes).
The routers also both have a firewall on board that by default drops all traffic, except the one allowed. We ...
- 103
0
votes
1
answer
30
views
ACLs block connection
Here is my configuration on ISP router:
interface GigabitEthernet0/0/0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255....
- 27
0
votes
0
answers
84
views
Use a single FortiSwitch in multiple, segmented networks
Is it possible to use a single switch in multiple, segmented and firewall protected subnets?
Looking at the above picture, I have this existing network WITHOUT the two inner firewalls. The switch is ...
- 1
1
vote
1
answer
139
views
Route traffic from firewall tunnel interface to server in Azure [closed]
On premise is a NAS that users access for file storage. Their AD server for authentication and GPO is in Azure.
For remote users, they have a Remote Access VPN client in which they connect to the ...
- 367
0
votes
0
answers
10
views
Trace Route RTO in two or more hop but next hop works [duplicate]
Today when I was doing tracert,
in the 2nd & 3rd and also 4th Hop I get RTO but my next hop seems to be reachable. How come it works?
Please answer asap.
- 1
0
votes
1
answer
89
views
How To get active vpn(site tot site) count from cisco FTD using ansible
I have been trying to get active VPN count from FTD firewalls using ansible, I tried the same on ASA and it have been running successfully. But when comes to FTD ansible, As it uses httpapi instead of ...
- 13
0
votes
2
answers
627
views
connect two private network using pfsense
I have two pfenses (say p1 and p2) in two separate networks. Each has a public IP. There is an internal network on each side (say n1 and n2). I want to connect these two networks through these two ...
2
votes
4
answers
152
views
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of ...
- 157
1
vote
0
answers
566
views
Cannot access to Fortigate FW through mgmt port after forming HA
The two FW are Fortigate WiFi 60E, OS v7.2.0 build1157.
The HA connection on the two FortiWifi60E was like
PC1-----Fortigate FW1-----Fortigate FW2-----PC2
PC1 IP:192.168.1.100
PC1 default gateway:192....
- 25
0
votes
1
answer
84
views
Blocking traffic means can't access that server?
I know this is a super newbie question.
I recently learn about firewall and you would know there is security levels.
The higher levels can send the traffic but cannot get it from the lower one.
I am ...
1
vote
1
answer
45
views
We want to see where the traffic is going on a Cisco 1140 firewall.. is there a way to do this? Need more than hitcounts [closed]
looking to see if there is a way to find out where traffic is going and coming from on a Cisco 1140 running FTD .... We need more than just a hit count...
- 11
2
votes
1
answer
447
views
Cisco NGFW FTD NAT/PAT pool exhaustion monitoring
We have a customer, who rarely experiences NAT/PAT pool exhaustion on their Cisco Firepower NGFW 4110. While syslog will helpfully notify us that there's an immediate problem, we would really like to ...
- 1,732
3
votes
1
answer
81
views
Valid uses for IPv4 Options [Community-Wiki]
Engineers building firewall rules often block all IPv4 packets with IPv4 Options set in the header. However, there are a few common and valid use-cases for IPv4 Options.
This Q&A is intended to ...
- 29.9k
0
votes
0
answers
26
views
Is it possible to create an IPS rule to Checkpoint 5200 PB-20 Firewall for Mysql packets
Is it possible to create an IPS rule to Checkpoint 5200 PB-20 Firewall that assesses the content from incoming packets for Mysql database server (port 3306)? If the packet is according to real Mysql ...
- 101
0
votes
1
answer
18
views
Is this possible? Adding a local device of my home network in client network without firewall configuration at client side (VPN?) [closed]
Let me explain what I want to achieve, but keep in mind that my networking knowledge is limited.
I want to login at a clients network to do some remote troubleshooting. And I want to use (for example) ...
- 1
4
votes
4
answers
2k
views
Do I get any security benefits by NATing a network that's already behind a firewall?
I'm deploying a new network for IOT devices, this new network will be behind a firewall. I've been suggested to also get the network natted to further improve security. Does this really add any ...
- 41
0
votes
1
answer
85
views
High availability vs network mac/arp config
Currently I test firewall HA settings and we observe some delays despite its active/passive config. Usually there should not be any interruption.Vendor explains this based on some configuration MAC/...
- 145
0
votes
1
answer
57
views
Where are the GCP Firewall logs?
It's a little tricky to find GCP Firewall logs the first time you look for them. Where are they?
- 29.9k
1
vote
1
answer
311
views
Cisco ASA not accepting external traffic without NAT configuration
First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing.
My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
- 121
0
votes
1
answer
131
views
Routing VLANs to Firewall Ports
My network has 3 VLANs: 10, 11, 12, and their address spaces are 10.0.X.0/24 where X is the VLAN ID. Their default gateway is a virtualized pfSense (even though it's virtual, I will use terminology as ...
- 3
0
votes
1
answer
879
views
VLAN and firewall interconnection
I'm encountering some difficulties to connect some VLANs to a physical firewall.
In details I have a core network with a L3 switch as a router and some L2 switches as access network. The network is ...
0
votes
3
answers
176
views
Is it best practice to restrict access from non-DMZ hosts to DMZ hosts? [closed]
I know that access should be restricted from DMZ hosts to non-DMZ hosts where possible (i.e., my web servers should only be able to talk to other internal resources where necessary). But is it best ...
- 101
5
votes
3
answers
3k
views
Difference between firewall and ACL
I have found many answers to this question, none of which satisfy me due to lack of detail.
Can someone please explain in detail what is a firewall and what is its purpose, and what is an ACL and what ...
- 151
1
vote
4
answers
557
views
What is the difference between having a firewall inside vs outside the network?
I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow.
The Question:
What would the use case scenario be for firewall outside vs. ...
- 131
0
votes
1
answer
543
views
TCP segment with flags ACK, PSH, URG
Can a TCP data segment with a 1 byte length have, at the same time, the flags ACK, PSH, URG set ? Is it conform or not to the TCP protocol ?
Thank you.
- 3
1
vote
1
answer
138
views
ARP cache in firewalls and difference from an end point device
Imagine a device A (192.168.32.5/24).
Then two hosts, B and C, connected to the same interface (through a switch) having the same IP address (192.168.32.8/24) configured statically. No fancy tools/...
- 134
0
votes
1
answer
263
views
Inherent flaw in stateless firewalls?
I am but a lowly (software) developer dabbling with setting up a network in AWS and am having trouble understanding the fundamentals of stateless firewalls, or Network ACLs as they're also referred to ...
- 3
2
votes
1
answer
92
views
Which ranges of IPv6 and IPv4 do requests to the local network and the host?
I'm looking for the range of IP address that is bound to the local network or the host itself.
So far for IPv4 I found:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255....
- 23
1
vote
1
answer
66
views
Does a Transparent Firewall need a Default gateway if directly connected to a layer 3 device that is actively performing routing?
Good folks of the Network Engineering stack!
I have a question that I assume most people could answer in their sleep. To better illustrate my question, I've provided a sketch of my network below.
In ...
- 13
0
votes
1
answer
79
views
Gateway with multiple VLAN IPs on one NIC [closed]
I would like to separate several hosts from the local network and put them behind a firewall. I would like to use VLANs to "physically" separate them instead of using just different subnets. ...
- 101
1
vote
0
answers
47
views
Pros and cons of directly interconnecting routers and firewalls vs via switch in an enterprise-network? [closed]
In a medium-sized enterprise network, let's say you have a pair of datacenter switches, a pair of distribution switches, a pair of internal core routers, a pair of firewalls, and a pair of edge ...
- 11
3
votes
1
answer
307
views
Juniper SRX 340 route lookup failed
I've a strange issue on my Juniper; I've a policy to allow all traffic to a specific address behind it and, in effect, the policy works correctly.
All the traffic I send reach the destination, except ...
- 361
1
vote
1
answer
551
views
Turning Off SPC card on Juniper SRX5800 series Firewall
We are running SRX5800 in a cluster. Each Node has FPCs as well as SPCs installed. Due to some maintenance downtime , we were required to power off FPCs as well as SPCs on a backup node , not in a ...
- 1,110
1
vote
0
answers
564
views
SOLVED: Check Point firewall log format through syslog [closed]
I receive logs from a series of Check Point firewalls that I don't manage and they are very thorough, containing every possible information about the communication. They're also formatted like field:&...
- 195
-1
votes
1
answer
58
views
Holding session option in Fortiweb
I have Frotiweb installed as my WAF and it is connected to FrotiSandbox for behavioral detection. In the WAF' File Security Policy, I have the "Hold Session While Scanning" turned off and &...
- 1
1
vote
1
answer
323
views
NAT in ASA (5505) Firewall is not working for VLANs configured in Layer3 Switch?
Toplogy:
Tool Used: Cisco Packet Tracer
Scenario:
NAT for hosts in any of the VLANs of Layer3-Switch not working.
Ping requests reaches outside server, but NAT is not working so ISP
Router can't ...
- 121
0
votes
1
answer
1k
views
How to configure NAT in Cisco ASA Firewall for all VLANs connected to layer 3 switch? [closed]
Topology:
How to set up NAT in Cisco ASA Firewall (in Packet Tracer), when there are VLANs in the network?
In the current approach, NAT is not working to reach the server (8.8.8.8) from any of the ...
- 121
0
votes
1
answer
139
views
Configure AAA on a router - Extended ACLs
How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
0
votes
1
answer
44
views
How to force routing to https website without the IP
I am attempting to limit a group of Chromebooks to access one particular site for student testing. The issue is that the website is secure but the ssl cert is attached to the url not the ip. The ip of ...
3
votes
1
answer
241
views
Which command is used in Cisco ASA Firewall to display the whole packet flow?
Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
0
votes
2
answers
2k
views
EdgeRouter X select one out of two WANs according to target IP range
I am using IPSET to define the interested IP range.
I want to direct packets to one out of two WAN connections according to an IP range. Here are my conditions.
A specific IP range. It is defined by ...
1
vote
1
answer
65
views
Does UDP can be exposed to stateful analysis?
From protocol theory we know that TCP is stateful protocol.
Different stateful packet filters do filtration based on connection state. I.e. it can distinguish responses and replies. It's obviously for ...
- 207
0
votes
0
answers
31
views
panic:integer divide fault Message Observed on SRX 5800 Routine Engine
We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
- 1,110