Questions tagged [firewall]
For questions about or relating to firewall operations, configuration and troubleshooting.
38
questions with no upvoted or accepted answers
4
votes
0answers
11k views
Problem ipsec site to site ASA
I am receiving this error when I try to establish an ipsec site to site vpn:
PSEC: Parsing PFKey GETSPI message
IPSEC: Creating IPsec SA
IPSEC: Getting the inbound SPI
IPSEC: New embryonic SA created ...
4
votes
2answers
1k views
SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ
I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine.
Now, I need to route one of the WAN IP ...
3
votes
0answers
429 views
TCAM utilization on Nexus 9396 switches
I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic.
I am reading about TCAM and wanted to ...
2
votes
0answers
157 views
Communication between subnets on Sonicwall firewall
I have a Sonicwall TZ-350. X0 is the default LAN with IP 192.168.10.1, and X1 is the WAN. I've set up a second local subnet on X2 with IP 192.168.20.1 for a single NAS device (no switch; the device is ...
2
votes
0answers
68 views
Looking for sanitized Palo Alto FW Config
This may sound a bit unusual, but I'm looking for someone who can answer with a sanitized Palo Alto FW text configuration with the following features used:
address-groups & service-groups
global-...
2
votes
0answers
256 views
How to redistribute BGP routes learned from AWS in one VR into another BGP running in another VR in Palo Alto firewall?
I have about 1000+ prefixes I am learning from AWS on Palo Alto through a BGP. This is on the secondary VR. Main VR is where my core routing is situated along with another BGP instance pointing to ...
2
votes
0answers
128 views
Why can't i reach devices in the other network?
I have 2 networks and want to connect them with each other. It should be possible that all devices in network A can communicate with devices on network B and other way round. 1 network is "managed" by ...
2
votes
0answers
169 views
very strange broadcast in LAN with Cisco ASA
Today i have detected Cisco ASA 5505 CPU usage went to 100% and LAN was flood with broadcast (ff:ff:ff:ff:ff) going to 10.0.12.255 address, i have noticed all these activity in wireshark that some ...
2
votes
0answers
221 views
Cisco ISR Zone Based Firewall dual stack not matching returning traffic for ipv6
I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the ...
2
votes
1answer
2k views
Sonicwall TZ105 Site to Site VPN Created can ping gateways but can't ping network from other site
Need help here
Site B
TZ105
x0 Lan 192.168.162.1
X1 WAN 64.x.x.x
X2 LAN 10.0.3.1
Site A
TZ300
X0 LAN 10.0.1.1
X1 WAN 69.x.x.x
VPN tunnel set up as VPN SITE TO SITE and is Green
From Site A I ...
2
votes
0answers
512 views
SonicWall tz100 WAN to LAN "Received"
Background: I am interning at a company with an existing network setup. They are currently using a SonicWall tz100 for their hardware firewall. They are also using the Windows firewall. They want ...
2
votes
1answer
70 views
Single IP address pointing to multiple different hosts?
We are having some touch panels put in that will control a new refrigeration system we are having put in. These panels can be set up for remote access, so if an alarm goes off they can make any ...
1
vote
0answers
232 views
Cisco ASA 5585-x Failover Virtual MAC address
I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
1
vote
2answers
142 views
Palo-Alto Interconnection
I am a novice with PaloAlto networks. For testing purposes, I have connected two PA-220 with each other. I configured the IP addresses from the same subnet. For me, like routers, these devices should ...
1
vote
0answers
734 views
Configure pfSense VLAN Trunk
I have setup a pfSense box as a transparent firewall between my Cisco router and first Cisco switch:
CISCO ROUTER - 10.10.1.253
↓
PFSENSE - OPT1 BRIDGE - 10.10.1.252
↓
CISCO CORE SWITCH - 10.10.1.250
...
1
vote
0answers
113 views
Firewall/Router not translating correctly
I am currently having trouble gaining internet access from the PC. Any suggestions or advice would be most welcome :)
In order to diagnose a much larger issue, I have scaled my lab configuration ...
1
vote
0answers
3k views
Dual Internet connections in active/standby mode without BGP
hello everyone
attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i ...
1
vote
0answers
81 views
Cisco ASA Hung - Error: "i82546GB/enadap_get: 2 not null"
We configured our new cisco ASA 5520 firewall device to act as RAVPN peer device. AAA is configured in such a way that user will get authenticate at our ACS 5.4 server. After completion of all other ...
0
votes
0answers
29 views
Active Peer [my FTD IP] already exists
I have configured the Cisco FTD and FMC, now I am trying to add the FTD Device to FMC but the system shows me such an error.
Active Peer [my FTD IP] already exists
and the the FTD Device doesn't ...
0
votes
1answer
65 views
Configure AAA on a router - Extended ACLs
How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
0
votes
1answer
158 views
EdgeRouter X select one out of two WANs according to target IP range
I am using IPSET to define the interested IP range.
I want to direct packets to one out of two WAN connections according to an IP range. Here are my conditions.
A specific IP range. It is defined by ...
0
votes
0answers
20 views
panic:integer divide fault Message Observed on SRX 5800 Routine Engine
We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
0
votes
0answers
44 views
Packet loss at irregular intervals
We have had significant packet loss issues since switching from Sophos UTM SG 310 to the Barracuda Cloud Gen F380 firewall. This has a big impact on live applications like telephony. It is noticeable ...
0
votes
0answers
37 views
How to configure ZPF with Tunnel?
I am trying to configure ZPF in a Cisco 4331 router in Packet Tracer. I have a tunnel interface for GRE tunnel in this router. But I am not being able to assign this tunnel interface to any zone due ...
0
votes
0answers
63 views
PaloAlto Application ID Signatures, 7-byte Regex Workaround
I'm in the process of creating some custom Application ID signatures, to give control over some in-house applications. In a nutshell, I've created signatures to match HTTP traffic using the http-req-...
0
votes
1answer
342 views
Cisco NAT - Overload PAT and Static nat from one inside to two outside interfaces
i have following setup
Cisco ISR4k Router with one inside LAN interface and two outside Interfaces.
---- WAN1 (NAT outside)
LAN (NAT inside) -- ISR4k |
...
0
votes
0answers
89 views
Cisco CML 2.0 strange ASA trunking issue
I am seeing very strange issue and now i am losing my mind so thought ask you folk. I have following two components connected point to point on Cisco CML 2.0
[nxos-9000v]--------------------[ASAv]
...
0
votes
0answers
27 views
How much additional processing time is needed for a combination DMZ configuration?
Please consider the DMZ configuration shown below.
(Image source: Testing Web Security: Assessing the Security of Web Sites and Applications by Steven Splaine)
And then let us consider the following (...
0
votes
1answer
3k views
How to forward port 80 and 443 on pfSense to a (internal) nginx webserver?
Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server.
Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2.
...
0
votes
3answers
626 views
Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)
I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access ...
0
votes
0answers
960 views
Cisco ASA and missing logs to syslog server
I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1.
When running the following settings I could see a lot of information in the buffer with ...
0
votes
3answers
272 views
Two 100mb ports on different networks on FortiGate 110C
If you allow me I have a quite far fetched question...
I have a fortigate 110C with a gigabit WAN port, 100mb LAN ports and a 200mb modem connected to the Fortigate.
Therefore I cant have 200mb/s ...
0
votes
0answers
265 views
QoS over IPSec Site-to-Site VPN: Concerns and Questions
(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
0
votes
1answer
92 views
Design of 2 Lans Connected to a Watchguard m570 firewall
I have this architecture (without the firewall). I bought a Watchguard M570 as Firewall to add it in my network. My Question is : Could i use my watchguard and connect this one to my 2 LoadBlancers ...
0
votes
0answers
66 views
cisco zone-based policy firewall
How to limit the number of established connections for each host, that connect to the service? In the policy settings, I found only blocking by the number of half open connections.
parameter-map type ...
0
votes
0answers
125 views
ASA - communication between 2 tunnels
I have two IPSEC tunnels with an ASA in the middle
Site A - 10.20.4.0 /24 (65.176.80.84)
Site B - 192.168.142.0 /24
ASA - 10.99.206.0 /24 (95.12.22.33
Site A - 10.20.4.0 /24 can reach the ASA and ...
-1
votes
1answer
36 views
Holding session option in Fortiweb
I have Frotiweb installed as my WAF and it is connected to FrotiSandbox for behavioral detection. In the WAF' File Security Policy, I have the "Hold Session While Scanning" turned off and &...
-1
votes
2answers
581 views
How to go from inside to outside (Firewall related question)
Im trying to get pinging/telnet enabled for a certain port so i can get through from outside to inside or vise versa. Just trying to figure out the configuration to get there.
I have made my inside ...
