Questions tagged [firewall]

For questions about or relating to firewall operations, configuration and troubleshooting.

37 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
11k views

Problem ipsec site to site ASA

I am receiving this error when I try to establish an ipsec site to site vpn: PSEC: Parsing PFKey GETSPI message IPSEC: Creating IPsec SA IPSEC: Getting the inbound SPI IPSEC: New embryonic SA created ...
user avatar
4 votes
2 answers
1k views

SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ

I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine. Now, I need to route one of the WAN IP ...
user avatar
3 votes
0 answers
500 views

TCAM utilization on Nexus 9396 switches

I have Cisco Nexus 9396 switch which is running L3 mode and i have configured bunch of IPv4 access-list in Ingress for firewalling to block certain traffic. I am reading about TCAM and wanted to ...
user avatar
  • 4,247
2 votes
0 answers
455 views

Communication between subnets on Sonicwall firewall

I have a Sonicwall TZ-350. X0 is the default LAN with IP 192.168.10.1, and X1 is the WAN. I've set up a second local subnet on X2 with IP 192.168.20.1 for a single NAS device (no switch; the device is ...
user avatar
  • 21
2 votes
0 answers
78 views

Looking for sanitized Palo Alto FW Config

This may sound a bit unusual, but I'm looking for someone who can answer with a sanitized Palo Alto FW text configuration with the following features used: address-groups & service-groups global-...
user avatar
2 votes
0 answers
393 views

How to redistribute BGP routes learned from AWS in one VR into another BGP running in another VR in Palo Alto firewall?

I have about 1000+ prefixes I am learning from AWS on Palo Alto through a BGP. This is on the secondary VR. Main VR is where my core routing is situated along with another BGP instance pointing to ...
user avatar
2 votes
0 answers
151 views

Why can't i reach devices in the other network?

I have 2 networks and want to connect them with each other. It should be possible that all devices in network A can communicate with devices on network B and other way round. 1 network is "managed" by ...
user avatar
  • 199
2 votes
0 answers
187 views

very strange broadcast in LAN with Cisco ASA

Today i have detected Cisco ASA 5505 CPU usage went to 100% and LAN was flood with broadcast (ff:ff:ff:ff:ff) going to 10.0.12.255 address, i have noticed all these activity in wireshark that some ...
user avatar
  • 4,247
2 votes
0 answers
237 views

Cisco ISR Zone Based Firewall dual stack not matching returning traffic for ipv6

I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the ...
user avatar
  • 141
2 votes
1 answer
2k views

Sonicwall TZ105 Site to Site VPN Created can ping gateways but can't ping network from other site

Need help here Site B TZ105 x0 Lan 192.168.162.1 X1 WAN 64.x.x.x X2 LAN 10.0.3.1 Site A TZ300 X0 LAN 10.0.1.1 X1 WAN 69.x.x.x VPN tunnel set up as VPN SITE TO SITE and is Green From Site A I ...
user avatar
  • 21
2 votes
0 answers
515 views

SonicWall tz100 WAN to LAN "Received"

Background: I am interning at a company with an existing network setup. They are currently using a SonicWall tz100 for their hardware firewall. They are also using the Windows firewall. They want ...
user avatar
  • 21
2 votes
1 answer
73 views

Single IP address pointing to multiple different hosts?

We are having some touch panels put in that will control a new refrigeration system we are having put in. These panels can be set up for remote access, so if an alarm goes off they can make any ...
user avatar
1 vote
4 answers
91 views

What is the difference between having a firewall inside vs outside the network?

I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow. The Question: What would the use case scenario be for firewall outside vs. ...
user avatar
1 vote
0 answers
307 views

Cisco ASA 5585-x Failover Virtual MAC address

I have configured Cisco ASA 5585-x with Active/Standby mode, cisco best practice saying you should use Virtual MAC address on interface to avoid traffic disruption when you do failover. now question ...
user avatar
  • 4,247
1 vote
0 answers
779 views

Configure pfSense VLAN Trunk

I have setup a pfSense box as a transparent firewall between my Cisco router and first Cisco switch: CISCO ROUTER - 10.10.1.253 ↓ PFSENSE - OPT1 BRIDGE - 10.10.1.252 ↓ CISCO CORE SWITCH - 10.10.1.250 ...
user avatar
1 vote
0 answers
114 views

Firewall/Router not translating correctly

I am currently having trouble gaining internet access from the PC. Any suggestions or advice would be most welcome :) In order to diagnose a much larger issue, I have scaled my lab configuration ...
user avatar
1 vote
0 answers
3k views

Dual Internet connections in active/standby mode without BGP

hello everyone attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i ...
user avatar
1 vote
0 answers
83 views

Cisco ASA Hung - Error: "i82546GB/enadap_get: 2 not null"

We configured our new cisco ASA 5520 firewall device to act as RAVPN peer device. AAA is configured in such a way that user will get authenticate at our ACS 5.4 server. After completion of all other ...
user avatar
  • 11
0 votes
0 answers
9 views

ASA 5525-X phantom IKEv2 tunnel cant be killed/logged off. Tunnel will only tx/rx one net and tx another

Trying to get a new site up on our network and having trouble with our ASA. I've successfully established a tunnel and am passing traffic on one network but only receiving it on another (sending is ...
user avatar
  • 1
0 votes
0 answers
139 views

Active Peer [my FTD IP] already exists

I have configured the Cisco FTD and FMC, now I am trying to add the FTD Device to FMC but the system shows me such an error. Active Peer [my FTD IP] already exists and the the FTD Device doesn't ...
user avatar
  • 1
0 votes
1 answer
110 views

Configure AAA on a router - Extended ACLs

How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
user avatar
0 votes
0 answers
24 views

panic:integer divide fault Message Observed on SRX 5800 Routine Engine

We are running 2 x Juniper SRX 5800 Firewalls in a cluster environment. Node 0 got rebooted and Node 1 took over the master role. Node 0 came back online after reboot. The reasons for Node 0 to reboot ...
user avatar
  • 1,058
0 votes
0 answers
52 views

Packet loss at irregular intervals

We have had significant packet loss issues since switching from Sophos UTM SG 310 to the Barracuda Cloud Gen F380 firewall. This has a big impact on live applications like telephony. It is noticeable ...
user avatar
0 votes
0 answers
89 views

PaloAlto Application ID Signatures, 7-byte Regex Workaround

I'm in the process of creating some custom Application ID signatures, to give control over some in-house applications. In a nutshell, I've created signatures to match HTTP traffic using the http-req-...
user avatar
0 votes
1 answer
481 views

Cisco NAT - Overload PAT and Static nat from one inside to two outside interfaces

i have following setup Cisco ISR4k Router with one inside LAN interface and two outside Interfaces. ---- WAN1 (NAT outside) LAN (NAT inside) -- ISR4k | ...
user avatar
0 votes
0 answers
114 views

Cisco CML 2.0 strange ASA trunking issue

I am seeing very strange issue and now i am losing my mind so thought ask you folk. I have following two components connected point to point on Cisco CML 2.0 [nxos-9000v]--------------------[ASAv] ...
user avatar
  • 4,247
0 votes
0 answers
27 views

How much additional processing time is needed for a combination DMZ configuration?

Please consider the DMZ configuration shown below. (Image source: Testing Web Security: Assessing the Security of Web Sites and Applications by Steven Splaine) And then let us consider the following (...
user avatar
  • 101
0 votes
1 answer
4k views

How to forward port 80 and 443 on pfSense to a (internal) nginx webserver?

Yesterday we did a "big bang" firewall switch in our company. Our new firewall is a pfSense server. Lets say our external ip is 84.1.1.1, pfSense is 192.168.1.1 and our web server ip is 192.168.1.2. ...
user avatar
  • 199
0 votes
3 answers
731 views

Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)

I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access ...
user avatar
  • 199
0 votes
0 answers
1k views

Cisco ASA and missing logs to syslog server

I would like to have some help with sending syslogs from a Cisco ASA 5555-X to a syslog server, graylog 3.2.1. When running the following settings I could see a lot of information in the buffer with ...
user avatar
  • 23
0 votes
3 answers
335 views

Two 100mb ports on different networks on FortiGate 110C

If you allow me I have a quite far fetched question... I have a fortigate 110C with a gigabit WAN port, 100mb LAN ports and a 200mb modem connected to the Fortigate. Therefore I cant have 200mb/s ...
user avatar
  • 1
0 votes
0 answers
354 views

QoS over IPSec Site-to-Site VPN: Concerns and Questions

(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
user avatar
0 votes
1 answer
99 views

Design of 2 Lans Connected to a Watchguard m570 firewall

I have this architecture (without the firewall). I bought a Watchguard M570 as Firewall to add it in my network. My Question is : Could i use my watchguard and connect this one to my 2 LoadBlancers ...
user avatar
  • 1
0 votes
0 answers
67 views

cisco zone-based policy firewall

How to limit the number of established connections for each host, that connect to the service? In the policy settings, I found only blocking by the number of half open connections. parameter-map type ...
user avatar
0 votes
0 answers
137 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
user avatar
-1 votes
1 answer
46 views

Holding session option in Fortiweb

I have Frotiweb installed as my WAF and it is connected to FrotiSandbox for behavioral detection. In the WAF' File Security Policy, I have the "Hold Session While Scanning" turned off and &...
user avatar
  • 1
-1 votes
2 answers
596 views

How to go from inside to outside (Firewall related question)

Im trying to get pinging/telnet enabled for a certain port so i can get through from outside to inside or vise versa. Just trying to figure out the configuration to get there. I have made my inside ...
user avatar
  • 115