Questions tagged [firewall]
For questions about or relating to firewall operations, configuration and troubleshooting.
595
questions
0
votes
0
answers
34
views
panic:integer divide fault Message Observed on SRX 5800 Routine Engine
We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
- 1,120
2
votes
0
answers
1k
views
Communication between subnets on Sonicwall firewall
I have a Sonicwall TZ-350. X0 is the default LAN with IP 192.168.10.1, and X1 is the WAN. I've set up a second local subnet on X2 with IP 192.168.20.1 for a single NAS device (no switch; the device is ...
- 121
0
votes
2
answers
531
views
Adding Second Interface with Different Public IP for Same Internet Connection
We have a situation that I'm not sure how to proceed correctly.
This location is currently utilizing two different firewalls - a Sophos XG 310 and a Sonicwall NSA 3500. The way this was originally ...
1
vote
1
answer
599
views
WatchGuard Geo Location for restricting access to VPN and "Access Portal"
Problem
We want to use WatchGuard's Geo Location to restrict access to our "Access Portal" and "Mobile VPN" connections, but see no options and the corresponding "Firewall ...
- 121
2
votes
2
answers
515
views
Where should I locate F5 Load Balancer in Network Segmentation?
I segmented my network and locate some important servers behind of firewall. So, I restricted traffic LAN (no segmentation between LAN clients, LAN servers) to/from important servers. These servers ...
- 121
1
vote
2
answers
182
views
Bridge mode or straight replacement?
Let's assume the ISP is malicious. They have remote access to their own gateway/router. No way to remove that remote access. But ISP allows using a different gateway/router. Security-wise, what is ...
- 175
1
vote
1
answer
2k
views
How to find invalid sessions on Juniper SRX 5800 series Firewall
In Juniper SRX 5800 series Firewall , when we run the command 'show security flow session summary node 0' , we see that it shows large numbers of sessions as invalidated. But we don't know ...
- 1,120
0
votes
0
answers
85
views
Packet loss at irregular intervals
We have had significant packet loss issues since switching from Sophos UTM SG 310 to the Barracuda Cloud Gen F380 firewall. This has a big impact on live applications like telephony. It is noticeable ...
0
votes
1
answer
39
views
Unable to Communicate from server to other servers after migrating from existing firewall to new firewall
In our existing environment we had migrated old firewall with new firewall after this activity . we had faced connectivity issue . From servers unable to reach other servers . Post clearing ARP table ...
user73774
1
vote
1
answer
26
views
Let me assume two firewall are connected in active -active mode ,how load sharing happen among two
i wants to know when two firewalls are connected in active -active mode for example A1 and A2 are connected in active -active . if session is initiated from A1 reverse traffic of this session will ...
user73768
0
votes
1
answer
39
views
What is the difference between these two different network security devices?
I have a choice between these two network security appliances, however the only difference I can see is the year and I don't know what that year means.
SONICWALL TZ300 WIRELESS-AC SECURE UPGRADE PLUS ...
- 103
1
vote
1
answer
96
views
Is it possible to configure DHCP on a router or UTM firewall for the multiple VLANs on L3 Switch?
I'm working on expanding our office network to accommodate more users/devices. Currently we have the DHCP configured on a UTM firewall(cyberoam ing50) device(cum router) providing IP addresses for ...
- 13
1
vote
2
answers
1k
views
Is TLS/SSL inspection throughput important while sizing a Firewall?
Our firm is planning on purchasing a Firewall solution, but are confused with the sizing requirement. We currently have 5 wired internet connections which make a total throughput of 500 Mbps (each ...
- 133
2
votes
0
answers
118
views
Looking for sanitized Palo Alto FW Config
This may sound a bit unusual, but I'm looking for someone who can answer with a sanitized Palo Alto FW text configuration with the following features used:
address-groups & service-groups
global-...
- 30k
0
votes
0
answers
146
views
PaloAlto Application ID Signatures, 7-byte Regex Workaround
I'm in the process of creating some custom Application ID signatures, to give control over some in-house applications. In a nutshell, I've created signatures to match HTTP traffic using the http-req-...
- 101
1
vote
0
answers
483
views
Cisco ASA 5585-x Failover Virtual MAC address
I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
- 4,379
0
votes
2
answers
99
views
How to find the client's application port during communication [closed]
After reading firewall rules about inbound and outbount I have some questions and the most sources focus on the server's ports.
What happens to the client side when is trying to make a connection to ...
user23106
2
votes
0
answers
848
views
How to redistribute BGP routes learned from AWS in one VR into another BGP running in another VR in Palo Alto firewall?
I have about 1000+ prefixes I am learning from AWS on Palo Alto through a BGP. This is on the secondary VR. Main VR is where my core routing is situated along with another BGP instance pointing to ...
- 136
2
votes
3
answers
2k
views
What is the difference between an ASA firewall and UTM firewall?
How do ASA firewalls and UTM perimeter firewalls differ?
- 167
1
vote
4
answers
375
views
How common it is to see unknown IPs in logs?
I have a server that streams video to YouTube/Twitch. I see [UFW BLOCK] entries in logs. One IP is 220.133.236.166, the other is 194.26.25.8. Is it a common thing that a server is connecting to my ...
- 13
0
votes
1
answer
106
views
answer packages rejected between mangle/prerouting and nat/prerouting
I am currently configuring a ubiquity edgerouter for our network. We have one uplink port (eth2) and two internal ports (eth0; with vlan 1) and eth3 (with vlans 2,3 and 4).
uplink and vlan 1 have ...
- 153
0
votes
1
answer
802
views
Cisco NAT - Overload PAT and Static nat from one inside to two outside interfaces
i have following setup
Cisco ISR4k Router with one inside LAN interface and two outside Interfaces.
---- WAN1 (NAT outside)
LAN (NAT inside) -- ISR4k |
...
- 536
0
votes
2
answers
114
views
Understanding IPV4 address range [duplicate]
I do have basic understanding of IP Address which is unique address for each System either in an organization or over the internet. But i want to understand what is IP address range
Lets Say we have ...
- 1
0
votes
0
answers
154
views
Cisco CML 2.0 strange ASA trunking issue
I am seeing very strange issue and now i am losing my mind so thought ask you folk. I have following two components connected point to point on Cisco CML 2.0
[nxos-9000v]--------------------[ASAv]
...
- 4,379
1
vote
3
answers
3k
views
Cisco SG-350 Switch and Fortigate Firewall Configuration
I'm not what you would call a Network Engineer, but right now i have a (somewhat) complex network problem that i have to solve. I must configure a SG-35028p cisco switch and a fortigate 60f firewall ...
0
votes
0
answers
27
views
How much additional processing time is needed for a combination DMZ configuration?
Please consider the DMZ configuration shown below.
(Image source: Testing Web Security: Assessing the Security of Web Sites and Applications by Steven Splaine)
And then let us consider the following (...
- 101
0
votes
1
answer
80
views
Public IP address does not work in internal network [closed]
I have configured port forwarding to my system from the router configuration menu, when I try to access the public IP address in the internal network it does not respond but it is accessible outside ...
- 101
0
votes
1
answer
8k
views
How to forward port 80 and 443 on pfSense to a (internal) nginx webserver?
Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server.
Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2.
...
- 219
0
votes
2
answers
310
views
How Does a Firewall (pfSense) Check Packets Against Rules
For packet rule testing, legacy 5 tuple based techniques employ decision tree, decomposition or hardware (usually TCAM) based approaches. What specific technique do pfSense firewalls employ to test ...
- 95
0
votes
1
answer
621
views
NTP Sync issues between Palo Alto 3260 and Juniper MX10003
I'm using a Microsemi S650 as the primary ntp server and a Juniper MX10003 as the secondary ntp server. I have the palo alto 3260 configured as follows:
[edit deviceconfig system ntp-servers]
...
- 157
2
votes
4
answers
6k
views
Firewall placement
Most diagrams I come across are as follows:
ISP > router > firewall
However, wouldn't you want a firewall before the router to protect the router? E.g ISP > firewall > router
- 515
2
votes
0
answers
352
views
Why can't i reach devices in the other network?
I have 2 networks and want to connect them with each other. It should be possible that all devices in network A can communicate with devices on network B and other way round. 1 network is "managed" by ...
- 219
0
votes
4
answers
1k
views
Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)
I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access ...
- 219
1
vote
1
answer
2k
views
Cisco anyconnect VPN router specific public IP via tunnel
I have fully functional cisco Anyconnect VPN running on Cisco ASA5585-X and today i got requirement that there are some remote public sites we need to whitelist our VPN public IP to access them over ...
- 4,379
1
vote
0
answers
37
views
How can one detect TLS inspection as a user with an enterprise managed device? [closed]
Let's assume Alice is an employee of the Company Chuck.
Alice likes to communicate with Bob, a server somewhere in the internet.
Chuck being a security orientated company, inspects all TLS connections ...
- 111
1
vote
1
answer
721
views
VLAN Subinterface Removal - CISCO ASA
The below are the configuration of the subinterfaces in Cisco ASA firewall and currently sub-interface 0/1.1 is only passing traffic and I need to remove 0/1.2 configuration from here as it is unused.
...
- 90
1
vote
2
answers
214
views
Palo-Alto Interconnection
I am a novice with PaloAlto networks. For testing purposes, I have connected two PA-220 with each other. I configured the IP addresses from the same subnet. For me, like routers, these devices should ...
- 145
1
vote
1
answer
52
views
NSA 2650 - traffic capped [closed]
I have an NSA 2650, firmware v 6.5.4.5-53n. Running only a few of the security services including content filter, gateway AV, IP, RBL filter, GEO-IP, and botnet filter (no DPI-SSL!). I'm trying to ...
1
vote
1
answer
2k
views
How to route traffic via firewall in EVPN + VxLAN
This is what i am trying to design new network, this is just on paper nothing finalized and i am sure it has lots of issue like firewall should be on leaf not border leaf etc. so that is why i am here ...
- 4,379
0
votes
3
answers
215
views
Best ports to use for proprietary protocols that might get inspected/blocked by firewalls
We use software from Genesys that uses its own proprietary protocols (all TCP) and we often run into issues with customers firewalls. The ports we are using are 2000, 2200 and 3010 - I'm not sure ...
- 115
0
votes
0
answers
2k
views
Cisco ASA and missing logs to syslog server
I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1.
When running the following settings I could see a lot of information in the buffer with ...
- 23
1
vote
2
answers
1k
views
2FA Setup for FortiGate SSL VPN
Just wanted to inquire if there is a way with FortiGate 60E to setup 2FA without setting-up a Forti-Authenticator or any additional costs? We are currently using this FW for our SSL VPN in our small ...
- 23
0
votes
3
answers
514
views
Two 100mb ports on different networks on FortiGate 110C
If you allow me I have a quite far fetched question...
I have a fortigate 110C with a gigabit WAN port, 100mb LAN ports and a 200mb modem connected to the Fortigate.
Therefore I cant have 200mb/s ...
- 1
0
votes
0
answers
10
views
Ipsec connection and nat only one site [duplicate]
There are two companies and two of them connected to each other with İPsec vpn. Company A has a server and company B want to reach to company A server. Which company need to configure nat on its ...
- 1
1
vote
1
answer
363
views
ASA shows Action:Drop on packet-tracer, no reason or phase
I am doing a very simple lab with one asa and two computers.
PC1 connected to dms
PC2 connected to outside
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA ...
- 37
0
votes
1
answer
74
views
How does ISP know which port to open for incoming answer from a site requesting, since sites answer in different ports from ones we ask? [closed]
I wondering how does ISP open door for incoming answer from a requesting site since the answer doesn't come from the requesting door, and how to achieve my computer IP since it's behind ISP firewall, ...
- 103
0
votes
0
answers
656
views
QoS over IPSec Site-to-Site VPN: Concerns and Questions
(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
- 181
1
vote
1
answer
53
views
User Upload Quota Fortigate - 501E (6.2.1)
Im using a Fortigate 501E.
my requirement is: Every user can’t upload more than 1 GB per day.
is it possible to implement the above requirement. Thanks
- 13
0
votes
1
answer
357
views
Unable to receive logs from a device to our SIEM Syslog server via TCP 514 [closed]
I want to collect logs from a security device (McAfee Email Gateway) to our SIEM Syslog server. This security device can forward logs only via TCP syslog on any port (in our case it is 514). We are ...
2
votes
1
answer
260
views
When is the source address of ICMPv6 message types 133, 135 and 136 other than unspecified(::/128) or link-local(fe80::/10)?
According to rfc4861 the source address for Router Solicitation(ICMPv6 type 133), Neighbor Solicitation(ICMPv6 type 135) and Neighbor Advertisement(ICMPv6 type 136) can be an address assigned to the ...
- 1,033