Questions tagged [firewall]
For questions about or relating to firewall operations, configuration and troubleshooting.
36
questions with no upvoted or accepted answers
4
votes
0answers
11k views
Problem ipsec site to site ASA
I am receiving this error when I try to establish an ipsec site to site vpn:
PSEC: Parsing PFKey GETSPI message
IPSEC: Creating IPsec SA
IPSEC: Getting the inbound SPI
IPSEC: New embryonic SA created ...
4
votes
2answers
1k views
SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ
I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine.
Now, I need to route one of the WAN IP ...
3
votes
2answers
239 views
What is the advantage of Supervised Machine Learning over Deep Packet Inspection in Network Traffic Classification?
As per the definition of Deep Packet Inspection (DPI), it uses signatures for packet filtering. Supervised Machine Learning can help put a label on a packet which does not get identified by Deep ...
3
votes
0answers
333 views
TCAM utilization on Nexus 9396 switches
I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic.
I am reading about TCAM and wanted to ...
2
votes
0answers
53 views
Looking for sanitized Palo Alto FW Config
This may sound a bit unusual, but I'm looking for someone who can answer with a sanitized Palo Alto FW text configuration with the following features used:
address-groups & service-groups
global-...
2
votes
0answers
93 views
Why can't i reach devices in the other network?
I have 2 networks and want to connect them with each other. It should be possible that all devices in network A can communicate with devices on network B and other way round. 1 network is "managed" by ...
2
votes
0answers
154 views
very strange broadcast in LAN with Cisco ASA
Today i have detected Cisco ASA 5505 CPU usage went to 100% and LAN was flood with broadcast (ff:ff:ff:ff:ff) going to 10.0.12.255 address, i have noticed all these activity in wireshark that some ...
2
votes
0answers
198 views
Cisco ISR Zone Based Firewall dual stack not matching returning traffic for ipv6
I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the ...
2
votes
1answer
2k views
Sonicwall TZ105 Site to Site VPN Created can ping gateways but can't ping network from other site
Need help here
Site B
TZ105
x0 Lan 192.168.162.1
X1 WAN 64.x.x.x
X2 LAN 10.0.3.1
Site A
TZ300
X0 LAN 10.0.1.1
X1 WAN 69.x.x.x
VPN tunnel set up as VPN SITE TO SITE and is Green
From Site A I ...
2
votes
0answers
508 views
SonicWall tz100 WAN to LAN “Received”
Background: I am interning at a company with an existing network setup. They are currently using a SonicWall tz100 for their hardware firewall. They are also using the Windows firewall. They want ...
2
votes
1answer
69 views
Single IP address pointing to multiple different hosts?
We are having some touch panels put in that will control a new refrigeration system we are having put in. These panels can be set up for remote access, so if an alarm goes off they can make any ...
1
vote
0answers
121 views
Cisco ASA 5585-x Failover Virtual MAC address
I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
1
vote
0answers
94 views
How to redistribute BGP routes learned from AWS in one VR into another BGP running in another VR in Palo Alto firewall?
I have about 1000+ prefixes I am learning from AWS on Palo Alto through a BGP. This is on the secondary VR. Main VR is where my core routing is situated along with another BGP instance pointing to ...
1
vote
2answers
109 views
Palo-Alto Interconnection
I am a novice with PaloAlto networks. For testing purposes, I have connected two PA-220 with each other. I configured the IP addresses from the same subnet. For me, like routers, these devices should ...
1
vote
0answers
682 views
Configure pfSense VLAN Trunk
I have setup a pfSense box as a transparent firewall between my Cisco router and first Cisco switch:
CISCO ROUTER - 10.10.1.253
↓
PFSENSE - OPT1 BRIDGE - 10.10.1.252
↓
CISCO CORE SWITCH - 10.10.1.250
...
1
vote
0answers
110 views
Firewall/Router not translating correctly
I am currently having trouble gaining internet access from the PC. Any suggestions or advice would be most welcome :)
In order to diagnose a much larger issue, I have scaled my lab configuration ...
1
vote
0answers
2k views
Dual Internet connections in active/standby mode without BGP
hello everyone
attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i ...
1
vote
0answers
81 views
Cisco ASA Hung - Error: “i82546GB/enadap_get: 2 not null”
We configured our new cisco ASA 5520 firewall device to act as RAVPN peer device. AAA is configured in such a way that user will get authenticate at our ACS 5.4 server. After completion of all other ...
0
votes
0answers
16 views
WatchGuard Geo Location for restricting access to VPN and “Access Portal”
Problem
We want to use WatchGuard's Geo Location to restrict access to our "Access Portal" and "Mobile VPN" connections, but see no options and the corresponding "Firewall ...
0
votes
1answer
14 views
Connect to application hosted in private network on a private DNS from outside world
I have an application hosted in a 2 VMs in a private network. Out of which one application is accessible from the outside world and the other one required private DNS. So outside users are not able to ...
0
votes
2answers
35 views
Bridge mode or straight replacement?
Let's assume the ISP is malicious. They have remote access to their own gateway/router. No way to remove that remote access. But ISP allows using a different gateway/router. Security-wise, what is ...
0
votes
0answers
34 views
Packet loss at irregular intervals
We have had significant packet loss issues since switching from Sophos UTM SG 310 to the Barracuda Cloud Gen F380 firewall. This has a big impact on live applications like telephony. It is noticeable ...
0
votes
0answers
18 views
How to configure ZPF with Tunnel?
I am trying to configure ZPF in a Cisco 4331 router in Packet Tracer. I have a tunnel interface for GRE tunnel in this router. But I am not being able to assign this tunnel interface to any zone due ...
0
votes
0answers
33 views
Adding a route that changes source IP
I am failing at trying to create a rule for the F5 to change the origination IP address based on the destination IP address.
Scenario - There is a web server that has three IP addresses assigned to it....
0
votes
0answers
24 views
PaloAlto Application ID Signatures, 7-byte Regex Workaround
I'm in the process of creating some custom Application ID signatures, to give control over some in-house applications. In a nutshell, I've created signatures to match HTTP traffic using the http-req-...
0
votes
0answers
57 views
Cisco CML 2.0 strange ASA trunking issue
I am seeing very strange issue and now i am losing my mind so thought ask you folk. I have following two components connected point to point on Cisco CML 2.0
[nxos-9000v]--------------------[ASAv]
...
0
votes
0answers
26 views
How much additional processing time is needed for a combination DMZ configuration?
Please consider the DMZ configuration shown below.
(Image source: Testing Web Security: Assessing the Security of Web Sites and Applications by Steven Splaine)
And then let us consider the following (...
0
votes
1answer
1k views
How to forward port 80 and 443 on pfSense to a (internal) nginx webserver?
Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server.
Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2.
...
0
votes
0answers
78 views
NTP Sync issues between Palo Alto 3260 and Juniper MX10003
I'm using a Microsemi S650 as the primary ntp server and a Juniper MX10003 as the secondary ntp server. I have the palo alto 3260 configured as follows:
[edit deviceconfig system ntp-servers]
...
0
votes
0answers
36 views
Locating where an IP address lives
Without documentation or using console how can I locate a particular IP within my network? Specific issue is I have public IP sitting on a device at a datacenter. The IP address appears to be going ...
0
votes
0answers
597 views
Cisco ASA and missing logs to syslog server
I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1.
When running the following settings I could see a lot of information in the buffer with ...
0
votes
0answers
129 views
QoS over IPSec Site-to-Site VPN: Concerns and Questions
(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
0
votes
1answer
70 views
Design of 2 Lans Connected to a Watchguard m570 firewall
I have this architecture (without the firewall). I bought a Watchguard M570 as Firewall to add it in my network. My Question is : Could i use my watchguard and connect this one to my 2 LoadBlancers ...
0
votes
0answers
59 views
cisco zone-based policy firewall
How to limit the number of established connections for each host, that connect to the service? In the policy settings, I found only blocking by the number of half open connections.
parameter-map type ...
0
votes
0answers
91 views
ASA - communication between 2 tunnels
I have two IPSEC tunnels with an ASA in the middle
Site A - 10.20.4.0 /24 (65.176.80.84)
Site B - 192.168.142.0 /24
ASA - 10.99.206.0 /24 (95.12.22.33
Site A - 10.20.4.0 /24 can reach the ASA and ...
-1
votes
2answers
563 views
How to go from inside to outside (Firewall related question)
Im trying to get pinging/telnet enabled for a certain port so i can get through from outside to inside or vise versa. Just trying to figure out the configuration to get there.
I have made my inside ...
