Questions tagged [firewall]
For questions about or relating to firewall operations, configuration and troubleshooting.
37
questions with no upvoted or accepted answers
4
votes
0
answers
11k
views
Problem ipsec site to site ASA
I am receiving this error when I try to establish an ipsec site to site vpn:
PSEC: Parsing PFKey GETSPI message
IPSEC: Creating IPsec SA
IPSEC: Getting the inbound SPI
IPSEC: New embryonic SA created ...
- 51
4
votes
2
answers
1k
views
SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ
I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine.
Now, I need to route one of the WAN IP ...
3
votes
0
answers
500
views
TCAM utilization on Nexus 9396 switches
I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic.
I am reading about TCAM and wanted to ...
- 4,247
2
votes
0
answers
455
views
Communication between subnets on Sonicwall firewall
I have a Sonicwall TZ-350. X0 is the default LAN with IP 192.168.10.1, and X1 is the WAN. I've set up a second local subnet on X2 with IP 192.168.20.1 for a single NAS device (no switch; the device is ...
- 21
2
votes
0
answers
78
views
Looking for sanitized Palo Alto FW Config
This may sound a bit unusual, but I'm looking for someone who can answer with a sanitized Palo Alto FW text configuration with the following features used:
address-groups & service-groups
global-...
- 29.6k
2
votes
0
answers
393
views
How to redistribute BGP routes learned from AWS in one VR into another BGP running in another VR in Palo Alto firewall?
I have about 1000+ prefixes I am learning from AWS on Palo Alto through a BGP. This is on the secondary VR. Main VR is where my core routing is situated along with another BGP instance pointing to ...
- 136
2
votes
0
answers
151
views
Why can't i reach devices in the other network?
I have 2 networks and want to connect them with each other. It should be possible that all devices in network A can communicate with devices on network B and other way round. 1 network is "managed" by ...
- 199
2
votes
0
answers
187
views
very strange broadcast in LAN with Cisco ASA
Today i have detected Cisco ASA 5505 CPU usage went to 100% and LAN was flood with broadcast (ff:ff:ff:ff:ff) going to 10.0.12.255 address, i have noticed all these activity in wireshark that some ...
- 4,247
2
votes
0
answers
237
views
Cisco ISR Zone Based Firewall dual stack not matching returning traffic for ipv6
I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the ...
- 141
2
votes
1
answer
2k
views
Sonicwall TZ105 Site to Site VPN Created can ping gateways but can't ping network from other site
Need help here
Site B
TZ105
x0 Lan 192.168.162.1
X1 WAN 64.x.x.x
X2 LAN 10.0.3.1
Site A
TZ300
X0 LAN 10.0.1.1
X1 WAN 69.x.x.x
VPN tunnel set up as VPN SITE TO SITE and is Green
From Site A I ...
- 21
2
votes
0
answers
515
views
SonicWall tz100 WAN to LAN "Received"
Background: I am interning at a company with an existing network setup. They are currently using a SonicWall tz100 for their hardware firewall. They are also using the Windows firewall. They want ...
- 21
2
votes
1
answer
73
views
Single IP address pointing to multiple different hosts?
We are having some touch panels put in that will control a new refrigeration system we are having put in. These panels can be set up for remote access, so if an alarm goes off they can make any ...
- 161
1
vote
4
answers
91
views
What is the difference between having a firewall inside vs outside the network?
I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow.
The Question:
What would the use case scenario be for firewall outside vs. ...
- 85
1
vote
0
answers
307
views
Cisco ASA 5585-x Failover Virtual MAC address
I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
- 4,247
1
vote
0
answers
779
views
Configure pfSense VLAN Trunk
I have setup a pfSense box as a transparent firewall between my Cisco router and first Cisco switch:
CISCO ROUTER - 10.10.1.253
↓
PFSENSE - OPT1 BRIDGE - 10.10.1.252
↓
CISCO CORE SWITCH - 10.10.1.250
...
- 84
1
vote
0
answers
114
views
Firewall/Router not translating correctly
I am currently having trouble gaining internet access from the PC. Any suggestions or advice would be most welcome :)
In order to diagnose a much larger issue, I have scaled my lab configuration ...
- 315
1
vote
0
answers
3k
views
Dual Internet connections in active/standby mode without BGP
hello everyone
attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i ...
- 11
1
vote
0
answers
83
views
Cisco ASA Hung - Error: "i82546GB/enadap_get: 2 not null"
We configured our new cisco ASA 5520 firewall device to act as RAVPN peer device. AAA is configured in such a way that user will get authenticate at our ACS 5.4 server. After completion of all other ...
- 11
0
votes
0
answers
9
views
ASA 5525-X phantom IKEv2 tunnel cant be killed/logged off. Tunnel will only tx/rx one net and tx another
Trying to get a new site up on our network and having trouble with our ASA. I've successfully established a tunnel and am passing traffic on one network but only receiving it on another (sending is ...
- 1
0
votes
0
answers
139
views
Active Peer [my FTD IP] already exists
I have configured the Cisco FTD and FMC, now I am trying to add the FTD Device to FMC but the system shows me such an error.
Active Peer [my FTD IP] already exists
and the the FTD Device doesn't ...
- 1
0
votes
1
answer
110
views
Configure AAA on a router - Extended ACLs
How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
0
votes
0
answers
24
views
panic:integer divide fault Message Observed on SRX 5800 Routine Engine
We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
- 1,058
0
votes
0
answers
52
views
Packet loss at irregular intervals
We have had significant packet loss issues since switching from Sophos UTM SG 310 to the Barracuda Cloud Gen F380 firewall. This has a big impact on live applications like telephony. It is noticeable ...
0
votes
0
answers
89
views
PaloAlto Application ID Signatures, 7-byte Regex Workaround
I'm in the process of creating some custom Application ID signatures, to give control over some in-house applications. In a nutshell, I've created signatures to match HTTP traffic using the http-req-...
- 101
0
votes
1
answer
481
views
Cisco NAT - Overload PAT and Static nat from one inside to two outside interfaces
i have following setup
Cisco ISR4k Router with one inside LAN interface and two outside Interfaces.
---- WAN1 (NAT outside)
LAN (NAT inside) -- ISR4k |
...
- 437
0
votes
0
answers
114
views
Cisco CML 2.0 strange ASA trunking issue
I am seeing very strange issue and now i am losing my mind so thought ask you folk. I have following two components connected point to point on Cisco CML 2.0
[nxos-9000v]--------------------[ASAv]
...
- 4,247
0
votes
0
answers
27
views
How much additional processing time is needed for a combination DMZ configuration?
Please consider the DMZ configuration shown below.
(Image source: Testing Web Security: Assessing the Security of Web Sites and Applications by Steven Splaine)
And then let us consider the following (...
- 101
0
votes
1
answer
4k
views
How to forward port 80 and 443 on pfSense to a (internal) nginx webserver?
Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server.
Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2.
...
- 199
0
votes
3
answers
731
views
Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)
I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access ...
- 199
0
votes
0
answers
1k
views
Cisco ASA and missing logs to syslog server
I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1.
When running the following settings I could see a lot of information in the buffer with ...
- 23
0
votes
3
answers
335
views
Two 100mb ports on different networks on FortiGate 110C
If you allow me I have a quite far fetched question...
I have a fortigate 110C with a gigabit WAN port, 100mb LAN ports and a 200mb modem connected to the Fortigate.
Therefore I cant have 200mb/s ...
- 1
0
votes
0
answers
354
views
QoS over IPSec Site-to-Site VPN: Concerns and Questions
(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
- 181
0
votes
1
answer
99
views
Design of 2 Lans Connected to a Watchguard m570 firewall
I have this architecture (without the firewall). I bought a Watchguard M570 as Firewall to add it in my network. My Question is : Could i use my watchguard and connect this one to my 2 LoadBlancers ...
- 1
0
votes
0
answers
67
views
cisco zone-based policy firewall
How to limit the number of established connections for each host, that connect to the service? In the policy settings, I found only blocking by the number of half open connections.
parameter-map type ...
0
votes
0
answers
137
views
ASA - communication between 2 tunnels
I have two IPSEC tunnels with an ASA in the middle
Site A - 10.20.4.0 /24 (65.176.80.84)
Site B - 192.168.142.0 /24
ASA - 10.99.206.0 /24 (95.12.22.33
Site A - 10.20.4.0 /24 can reach the ASA and ...
- 1
-1
votes
1
answer
46
views
Holding session option in Fortiweb
I have Frotiweb installed as my WAF and it is connected to FrotiSandbox for behavioral detection. In the WAF' File Security Policy, I have the "Hold Session While Scanning" turned off and &...
- 1
-1
votes
2
answers
596
views
How to go from inside to outside (Firewall related question)
Im trying to get pinging/telnet enabled for a certain port so i can get through from outside to inside or vise versa. Just trying to figure out the configuration to get there.
I have made my inside ...
- 115