Questions tagged [firewall]
For questions about or relating to firewall operations, configuration and troubleshooting.
594
questions
2
votes
1
answer
2k
views
Sonicwall TZ105 Site to Site VPN Created can ping gateways but can't ping network from other site
Need help here
Site B
TZ105
x0 Lan 192.168.162.1
X1 WAN 64.x.x.x
X2 LAN 10.0.3.1
Site A
TZ300
X0 LAN 10.0.1.1
X1 WAN 69.x.x.x
VPN tunnel set up as VPN SITE TO SITE and is Green
From Site A I ...
CommunityBot
- 1
0
votes
0
answers
16
views
What can be the cause of an icmp comming from a remote public IP reaching a private IP? [closed]
The context:
I have the following simplified topology:
Internet --- ISP Router --- Firewall --- ...
The ISP router is a CGA2121 (cable modem with telephony), which is more or less a black box to me ...
- 101
6
votes
2
answers
1k
views
SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ
I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine.
Now, I need to route one of the WAN IP ...
CommunityBot
- 1
2
votes
4
answers
152
views
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of ...
- 11
0
votes
2
answers
621
views
How to go from inside to outside (Firewall related question)
Im trying to get pinging/telnet enabled for a certain port so i can get through from outside to inside or vise versa. Just trying to figure out the configuration to get there.
I have made my inside ...
CommunityBot
- 1
0
votes
1
answer
53
views
How to use 5 static ip addresses with virgin media broad band
I have installed virgin media business broadband and the package comes with 5 static ips. These IP are GRE tunnels from the HITRON router to virgin.
the IP addresses are for example
66.66.66.65 - 66....
- 81.6k
0
votes
1
answer
139
views
Configure AAA on a router - Extended ACLs
How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
CommunityBot
- 1
0
votes
1
answer
7k
views
How to forward port 80 and 443 on pfSense to a (internal) nginx webserver?
Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server.
Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2.
...
CommunityBot
- 1
3
votes
1
answer
290
views
very strange broadcast in LAN with Cisco ASA
Today i have detected Cisco ASA 5505 CPU usage went to 100% and LAN was flood with broadcast (ff:ff:ff:ff:ff) going to 10.0.12.255 address, i have noticed all these activity in wireshark that some ...
CommunityBot
- 1
3
votes
1
answer
299
views
Cisco ISR Zone Based Firewall dual stack not matching returning traffic for ipv6
I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the ...
CommunityBot
- 1
0
votes
1
answer
89
views
How To get active vpn(site tot site) count from cisco FTD using ansible
I have been trying to get active VPN count from FTD firewalls using ansible, I tried the same on ASA and it have been running successfully. But when comes to FTD ansible, As it uses httpapi instead of ...
CommunityBot
- 1
0
votes
1
answer
683
views
Cisco NAT - Overload PAT and Static nat from one inside to two outside interfaces
i have following setup
Cisco ISR4k Router with one inside LAN interface and two outside Interfaces.
---- WAN1 (NAT outside)
LAN (NAT inside) -- ISR4k |
...
CommunityBot
- 1
0
votes
1
answer
151
views
Design of 2 Lans Connected to a Watchguard m570 firewall
I have this architecture (without the firewall). I bought a Watchguard M570 as Firewall to add it in my network. My Question is : Could i use my watchguard and connect this one to my 2 LoadBlancers ...
CommunityBot
- 1
0
votes
1
answer
57
views
DMZ cannot send traffic to INSIDE (Cisco ASA 5505)
Have a nice day, everyone.
I have a question while working with Cisco ASA 5505 firewall. I want to create a interface/VLAN for DMZ. To do this:
int vlan 3
no forward interface vlan 1
nameif dmz
...
CommunityBot
- 1
0
votes
1
answer
84
views
Blocking traffic means can't access that server?
I know this is a super newbie question.
I recently learn about firewall and you would know there is security levels.
The higher levels can send the traffic but cannot get it from the lower one.
I am ...
CommunityBot
- 1
0
votes
1
answer
69
views
Router to Wireless router (Packet Tracer)
Hi, Can anyone help why I can't ping from my pc in office network to my laptop in guest network or wireless network. It is possible to ping from guest network to office but failed vice versa.
Main ...
- 1,951
0
votes
1
answer
41
views
How to prevent a user from using YouTube while connected to my network [closed]
i need to restrick specific user from using youtube and other socialmedia during job time
- 1,951
0
votes
1
answer
75
views
Juniper SRX, workstation on SRX switch port cannot ping reth interface
I have a SRX345 firewall that has a workstation hanging off one of its ethernet ports.
The workstation cannot ping the SRX reth interface, reth1.50 (its default gw) even though the ethernet port is ...
- 9,381
0
votes
1
answer
128
views
Why does pfSense require a DNS access list entry when all interfaces are selected?
Netgate 4100
v23.05-RELEASE
The DNS Resolver was only working on LAN 1 but not LAN 3 (physical nics, not vlans). I added an access list rule as suggested here to grant LAN 3 access and now ...
- 101
0
votes
1
answer
41
views
Allow active connections in firewall on multiple BGP connected routers
We have a network on its own AS with 2 routers connected to 2 AS via BGP (full routes).
The routers also both have a firewall on board that by default drops all traffic, except the one allowed. We ...
- 17k
1
vote
1
answer
139
views
Route traffic from firewall tunnel interface to server in Azure [closed]
On premise is a NAS that users access for file storage. Their AD server for authentication and GPO is in Azure.
For remote users, they have a Remote Access VPN client in which they connect to the ...
- 367
0
votes
1
answer
30
views
ACLs block connection
Here is my configuration on ISP router:
interface GigabitEthernet0/0/0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255....
- 1,951
0
votes
0
answers
84
views
Use a single FortiSwitch in multiple, segmented networks
Is it possible to use a single switch in multiple, segmented and firewall protected subnets?
Looking at the above picture, I have this existing network WITHOUT the two inner firewalls. The switch is ...
- 1
0
votes
0
answers
10
views
Trace Route RTO in two or more hop but next hop works [duplicate]
Today when I was doing tracert,
in the 2nd & 3rd and also 4th Hop I get RTO but my next hop seems to be reachable. How come it works?
Please answer asap.
- 1
0
votes
2
answers
627
views
connect two private network using pfsense
I have two pfenses (say p1 and p2) in two separate networks. Each has a public IP. There is an internal network on each side (say n1 and n2). I want to connect these two networks through these two ...
- 81.6k
1
vote
0
answers
566
views
Cannot access to Fortigate FW through mgmt port after forming HA
The two FW are Fortigate WiFi 60E, OS v7.2.0 build1157.
The HA connection on the two FortiWifi60E was like
PC1-----Fortigate FW1-----Fortigate FW2-----PC2
PC1 IP:192.168.1.100
PC1 default gateway:192....
- 25
1
vote
1
answer
45
views
We want to see where the traffic is going on a Cisco 1140 firewall.. is there a way to do this? Need more than hitcounts [closed]
looking to see if there is a way to find out where traffic is going and coming from on a Cisco 1140 running FTD .... We need more than just a hit count...
- 1,951
2
votes
1
answer
447
views
Cisco NGFW FTD NAT/PAT pool exhaustion monitoring
We have a customer, who rarely experiences NAT/PAT pool exhaustion on their Cisco Firepower NGFW 4110. While syslog will helpfully notify us that there's an immediate problem, we would really like to ...
- 1,951
3
votes
1
answer
81
views
Valid uses for IPv4 Options [Community-Wiki]
Engineers building firewall rules often block all IPv4 packets with IPv4 Options set in the header. However, there are a few common and valid use-cases for IPv4 Options.
This Q&A is intended to ...
- 29.9k
0
votes
4
answers
927
views
Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)
I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access ...
- 219
3
votes
1
answer
313
views
Cisco IP Fragments ACL strange behavior
I am testing following ACL on Cisco 3850 L3 switch :
C3850#show ip access-lists 101
Extended IP access list 101
10 deny ip any any fragments
20 permit ip any any (268 matches)
I applied ...
- 98.4k
0
votes
0
answers
26
views
Is it possible to create an IPS rule to Checkpoint 5200 PB-20 Firewall for Mysql packets
Is it possible to create an IPS rule to Checkpoint 5200 PB-20 Firewall that assesses the content from incoming packets for Mysql database server (port 3306)? If the packet is according to real Mysql ...
- 98.4k
0
votes
3
answers
470
views
Two 100mb ports on different networks on FortiGate 110C
If you allow me I have a quite far fetched question...
I have a fortigate 110C with a gigabit WAN port, 100mb LAN ports and a 200mb modem connected to the Fortigate.
Therefore I cant have 200mb/s ...
CommunityBot
- 1
4
votes
4
answers
2k
views
Do I get any security benefits by NATing a network that's already behind a firewall?
I'm deploying a new network for IOT devices, this new network will be behind a firewall. I've been suggested to also get the network natted to further improve security. Does this really add any ...
- 81.6k
0
votes
1
answer
18
views
Is this possible? Adding a local device of my home network in client network without firewall configuration at client side (VPN?) [closed]
Let me explain what I want to achieve, but keep in mind that my networking knowledge is limited.
I want to login at a clients network to do some remote troubleshooting. And I want to use (for example) ...
- 19.4k
1
vote
4
answers
557
views
What is the difference between having a firewall inside vs outside the network?
I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow.
The Question:
What would the use case scenario be for firewall outside vs. ...
CommunityBot
- 1
0
votes
1
answer
85
views
High availability vs network mac/arp config
Currently I test firewall HA settings and we observe some delays despite its active/passive config. Usually there should not be any interruption.Vendor explains this based on some configuration MAC/...
- 8,739
1
vote
2
answers
1k
views
2FA Setup for FortiGate SSL VPN
Just wanted to inquire if there is a way with FortiGate 60E to setup 2FA without setting-up a Forti-Authenticator or any additional costs? We are currently using this FW for our SSL VPN in our small ...
- 164
0
votes
1
answer
57
views
Where are the GCP Firewall logs?
It's a little tricky to find GCP Firewall logs the first time you look for them. Where are they?
- 29.9k
1
vote
1
answer
311
views
Cisco ASA not accepting external traffic without NAT configuration
First of all, I am quite newie in the cisco world, so this could be some easy stuff that I'm missing.
My first problem is trying to understand why a Cisco ASA5585 does not show traffic while doing a ...
- 121
7
votes
2
answers
12k
views
ASA IPS issue: routing and management interface
We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
- 11
0
votes
2
answers
2k
views
EdgeRouter X select one out of two WANs according to target IP range
I am using IPSET to define the interested IP range.
I want to direct packets to one out of two WAN connections according to an IP range. Here are my conditions.
A specific IP range. It is defined by ...
- 81.6k
1
vote
1
answer
2k
views
Cisco anyconnect VPN router specific public IP via tunnel
I have fully functional cisco Anyconnect VPN running on Cisco ASA5585-X and today i got requirement that there are some remote public sites we need to whitelist our VPN public IP to access them over ...
0
votes
1
answer
131
views
Routing VLANs to Firewall Ports
My network has 3 VLANs: 10, 11, 12, and their address spaces are 10.0.X.0/24 where X is the VLAN ID. Their default gateway is a virtualized pfSense (even though it's virtual, I will use terminology as ...
- 66.9k
2
votes
0
answers
679
views
How to redistribute BGP routes learned from AWS in one VR into another BGP running in another VR in Palo Alto firewall?
I have about 1000+ prefixes I am learning from AWS on Palo Alto through a BGP. This is on the secondary VR. Main VR is where my core routing is situated along with another BGP instance pointing to ...
- 1
0
votes
1
answer
879
views
VLAN and firewall interconnection
I'm encountering some difficulties to connect some VLANs to a physical firewall.
In details I have a core network with a L3 switch as a router and some L2 switches as access network. The network is ...
- 81.6k
0
votes
3
answers
176
views
Is it best practice to restrict access from non-DMZ hosts to DMZ hosts? [closed]
I know that access should be restricted from DMZ hosts to non-DMZ hosts where possible (i.e., my web servers should only be able to talk to other internal resources where necessary). But is it best ...
- 81.6k
5
votes
3
answers
3k
views
Difference between firewall and ACL
I have found many answers to this question, none of which satisfy me due to lack of detail.
Can someone please explain in detail what is a firewall and what is its purpose, and what is an ACL and what ...
- 436
1
vote
2
answers
194
views
Palo-Alto Interconnection
I am a novice with PaloAlto networks. For testing purposes, I have connected two PA-220 with each other. I configured the IP addresses from the same subnet. For me, like routers, these devices should ...
CommunityBot
- 1
0
votes
1
answer
543
views
TCP segment with flags ACK, PSH, URG
Can a TCP data segment with a 1 byte length have, at the same time, the flags ACK, PSH, URG set ? Is it conform or not to the TCP protocol ?
Thank you.
- 81.6k