Skip to main content

Questions tagged [firewall]

For questions about or relating to firewall operations, configuration and troubleshooting.

Filter by
Sorted by
Tagged with
0 votes
1 answer
187 views

How To get active vpn(site tot site) count from cisco FTD using ansible

I have been trying to get active VPN count from FTD firewalls using ansible, I tried the same on ASA and it have been running successfully. But when comes to FTD ansible, As it uses httpapi instead of ...
0 votes
1 answer
897 views

Cisco NAT - Overload PAT and Static nat from one inside to two outside interfaces

i have following setup Cisco ISR4k Router with one inside LAN interface and two outside Interfaces. ---- WAN1 (NAT outside) LAN (NAT inside) -- ISR4k | ...
0 votes
1 answer
195 views

Design of 2 Lans Connected to a Watchguard m570 firewall

I have this architecture (without the firewall). I bought a Watchguard M570 as Firewall to add it in my network. My Question is : Could i use my watchguard and connect this one to my 2 LoadBlancers ...
0 votes
1 answer
202 views

DMZ cannot send traffic to INSIDE (Cisco ASA 5505)

Have a nice day, everyone. I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this: int vlan 3 no forward interface vlan 1 nameif dmz ...
2 votes
1 answer
2k views

Sonicwall TZ105 Site to Site VPN Created can ping gateways but can't ping network from other site

Need help here Site B TZ105 x0 Lan 192.168.162.1 X1 WAN 64.x.x.x X2 LAN 10.0.3.1 Site A TZ300 X0 LAN 10.0.1.1 X1 WAN 69.x.x.x VPN tunnel set up as VPN SITE TO SITE and is Green From Site A I ...
6 votes
2 answers
1k views

SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ

I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine. Now, I need to route one of the WAN IP ...
1 vote
1 answer
260 views

Route traffic from firewall tunnel interface to server in Azure [closed]

Situation: On premise is a NAS that users access for file storage. Their AD server for authentication and GPO resides in Azure and is connected with a LAN to LAN VPN. For remote workers, they have a ...
0 votes
0 answers
40 views

Lancom Failover Configuration does not use LTE after following their documentation

I have tried to configure a Lancom 1900EF-5G Firewall. It is running the latest firmware (10.80.0450SU4). I want to configure SD WAN Dynamic Path Selection. I have three ISP connections. Two fiber ...
0 votes
1 answer
46 views

Puppet on Forti os, Is it possible?

I basicaly wanted to know if it is possible to download and configure puppet-client on a fortigate to be able to push configuration manifests from the puppet-server ? I already know that some tools ...
1 vote
1 answer
102 views

My Fortinet Firewall shows 100Mbps (100%) bandwidth usage in the BD dashboard but Fortiview sources do not show much usage. Facing connectivity issue!

I am working with a Fortinet FG-60F firewall. It has 2 WAN sources and both have a maximum link speed of 100Mbps. Throughout the day, I am repeatedly getting downstream bandwidth spikes of 100Mbps+ on ...
1 vote
1 answer
435 views

How can I view the bandwidth usage of a specific interface over a period of time on Fortinet without using a FortiAnalyzer instance?

My company utilizes a Fortinet firewall, but we currently do not have a FortiAnalyzer. We are seeking to obtain statistics on the usage of an internet interface's bandwidth, specifically over a 24-...
0 votes
2 answers
645 views

How to go from inside to outside (Firewall related question)

Im trying to get pinging/telnet enabled for a certain port so i can get through from outside to inside or vise versa. Just trying to figure out the configuration to get there. I have made my inside ...
1 vote
0 answers
15 views

Firewall not reverse translating NAT address in VyOS GNS3

I'm using two VyOS images as Firewalls in gns3, to which I have connected two routers, one from an inside network and another from an outside network. I configured NAT in both for the internal ...
1 vote
1 answer
176 views

Configure AAA on a router - Extended ACLs

How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
0 votes
1 answer
9k views

How to forward port 80 and 443 on pfSense to a (internal) nginx webserver?

Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server. Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2. ...
3 votes
1 answer
365 views

very strange broadcast in LAN with Cisco ASA

Today i have detected Cisco ASA 5505 CPU usage went to 100% and LAN was flood with broadcast (ff:ff:ff:ff:ff) going to 10.0.12.255 address, i have noticed all these activity in wireshark that some ...
3 votes
1 answer
329 views

Cisco ISR Zone Based Firewall dual stack not matching returning traffic for ipv6

I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the ...
0 votes
1 answer
198 views

Blocking traffic means can't access that server?

I know this is a super newbie question. I recently learn about firewall and you would know there is security levels. The higher levels can send the traffic but cannot get it from the lower one. I am ...
0 votes
1 answer
168 views

Problem with Configuring Selective DNAT for HTTP Traffic on Fortigate Firewall

I'm currently in the process of setting up a new Fortigate Firewall and have run into an issue while configuring DNAT. From what I understand, this is done through Virtual IPs in Fortigate. My goal is ...
2 votes
0 answers
932 views

How to redistribute BGP routes learned from AWS in one VR into another BGP running in another VR in Palo Alto firewall?

I have about 1000+ prefixes I am learning from AWS on Palo Alto through a BGP. This is on the secondary VR. Main VR is where my core routing is situated along with another BGP instance pointing to ...
0 votes
0 answers
136 views

palo alto firewall dynamic address group is not working

I am testing a simple dynamic address group (DAG) based on policy tag matching...but the when I add the DAG to the policy all traffic stops and no IPs ever populate the DAG. I verified the LFP ...
2 votes
0 answers
126 views

Looking for sanitized Palo Alto FW Config

This may sound a bit unusual, but I'm looking for someone who can answer with a sanitized Palo Alto FW text configuration with the following features used: address-groups & service-groups global-...
0 votes
1 answer
46 views

Protect public network with virtual firewall w/o control over the gateway

I have a public network, 123.123.123.0/28, and a local network, 192.168.1.0/24. My ISP gateway for the public network is 123.123.123.1. My virtual firewall and router (pfsense) is running inside ...
2 votes
4 answers
460 views

Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of ...
1 vote
1 answer
643 views

How to use 5 static ip addresses with virgin media broad band

I have installed virgin media business broadband and the package comes with 5 static ips. These IP are GRE tunnels from the HITRON router to virgin. the IP addresses are for example 66.66.66.65 - 66....
0 votes
1 answer
454 views

Router to Wireless router (Packet Tracer)

Hi, Can anyone help why I can't ping from my pc in office network to my laptop in guest network or wireless network. It is possible to ping from guest network to office but failed vice versa. Main ...
0 votes
1 answer
48 views

How to prevent a user from using YouTube while connected to my network [closed]

i need to restrick specific user from using youtube and other socialmedia during job time
0 votes
1 answer
237 views

Juniper SRX, workstation on SRX switch port cannot ping reth interface

I have a SRX345 firewall that has a workstation hanging off one of its ethernet ports. The workstation cannot ping the SRX reth interface, reth1.50 (its default gw) even though the ethernet port is ...
0 votes
1 answer
506 views

Why does pfSense require a DNS access list entry when all interfaces are selected?

Netgate 4100 v23.05-RELEASE The DNS Resolver was only working on LAN 1 but not LAN 3 (physical nics, not vlans). I added an access list rule as suggested here to grant LAN 3 access and now ...
0 votes
1 answer
71 views

Allow active connections in firewall on multiple BGP connected routers

We have a network on its own AS with 2 routers connected to 2 AS via BGP (full routes). The routers also both have a firewall on board that by default drops all traffic, except the one allowed. We ...
0 votes
1 answer
39 views

ACLs block connection

Here is my configuration on ISP router: interface GigabitEthernet0/0/0 no ip address duplex auto speed auto ! interface GigabitEthernet0/0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255....
0 votes
2 answers
2k views

connect two private network using pfsense

I have two pfenses (say p1 and p2) in two separate networks. Each has a public IP. There is an internal network on each side (say n1 and n2). I want to connect these two networks through these two ...
1 vote
0 answers
1k views

Cannot access to Fortigate FW through mgmt port after forming HA

The two FW are Fortigate WiFi 60E, OS v7.2.0 build1157. The HA connection on the two FortiWifi60E was like PC1-----Fortigate FW1-----Fortigate FW2-----PC2 PC1 IP:192.168.1.100 PC1 default gateway:192....
1 vote
1 answer
105 views

We want to see where the traffic is going on a Cisco 1140 firewall.. is there a way to do this? Need more than hitcounts [closed]

looking to see if there is a way to find out where traffic is going and coming from on a Cisco 1140 running FTD .... We need more than just a hit count...
2 votes
1 answer
1k views

Cisco NGFW FTD NAT/PAT pool exhaustion monitoring

We have a customer, who rarely experiences NAT/PAT pool exhaustion on their Cisco Firepower NGFW 4110. While syslog will helpfully notify us that there's an immediate problem, we would really like to ...
3 votes
1 answer
178 views

Valid uses for IPv4 Options [Community-Wiki]

Engineers building firewall rules often block all IPv4 packets with IPv4 Options set in the header. However, there are a few common and valid use-cases for IPv4 Options. This Q&A is intended to ...
0 votes
4 answers
1k views

Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)

I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access ...
3 votes
1 answer
358 views

Cisco IP Fragments ACL strange behavior

I am testing following ACL on Cisco 3850 L3 switch : C3850#show ip access-lists 101 Extended IP access list 101 10 deny ip any any fragments 20 permit ip any any (268 matches) I applied ...
0 votes
0 answers
30 views

Is it possible to create an IPS rule to Checkpoint 5200 PB-20 Firewall for Mysql packets

Is it possible to create an IPS rule to Checkpoint 5200 PB-20 Firewall that assesses the content from incoming packets for Mysql database server (port 3306)? If the packet is according to real Mysql ...
0 votes
3 answers
535 views

Two 100mb ports on different networks on FortiGate 110C

If you allow me I have a quite far fetched question... I have a fortigate 110C with a gigabit WAN port, 100mb LAN ports and a 200mb modem connected to the Fortigate. Therefore I cant have 200mb/s ...
4 votes
4 answers
2k views

Do I get any security benefits by NATing a network that's already behind a firewall?

I'm deploying a new network for IOT devices, this new network will be behind a firewall. I've been suggested to also get the network natted to further improve security. Does this really add any ...
0 votes
1 answer
19 views

Is this possible? Adding a local device of my home network in client network without firewall configuration at client side (VPN?) [closed]

Let me explain what I want to achieve, but keep in mind that my networking knowledge is limited. I want to login at a clients network to do some remote troubleshooting. And I want to use (for example) ...
1 vote
4 answers
1k views

What is the difference between having a firewall inside vs outside the network?

I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow. The Question: What would the use case scenario be for firewall outside vs. ...
0 votes
1 answer
174 views

High availability vs network mac/arp config

Currently I test firewall HA settings and we observe some delays despite its active/passive config. Usually there should not be any interruption.Vendor explains this based on some configuration MAC/...
1 vote
2 answers
2k views

2FA Setup for FortiGate SSL VPN

Just wanted to inquire if there is a way with FortiGate 60E to setup 2FA without setting-up a Forti-Authenticator or any additional costs? We are currently using this FW for our SSL VPN in our small ...
0 votes
1 answer
79 views

Where are the GCP Firewall logs?

It's a little tricky to find GCP Firewall logs the first time you look for them. Where are they?
1 vote
1 answer
567 views

Cisco ASA not accepting external traffic without NAT configuration

First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing. My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
7 votes
2 answers
12k views

ASA IPS issue: routing and management interface

We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
0 votes
2 answers
2k views

EdgeRouter X select one out of two WANs according to target IP range

I am using IPSET to define the interested IP range. I want to direct packets to one out of two WAN connections according to an IP range. Here are my conditions. A specific IP range. It is defined by ...
1 vote
1 answer
2k views

Cisco anyconnect VPN router specific public IP via tunnel

I have fully functional cisco Anyconnect VPN running on Cisco ASA5585-X and today i got requirement that there are some remote public sites we need to whitelist our VPN public IP to access them over ...

1
2 3 4 5
12