Questions tagged [firewall]

For questions about or relating to firewall operations, configuration and troubleshooting.

Filter by
Sorted by
Tagged with
25 votes
1 answer
918 views

Should IPv4 ICMP from untrusted interfaces be blocked?

Searching around I haven't been able to determine the best practice for ICMP on a firewall. For example on a Cisco ASA would it be safe and recommended to allow ICMP from any if ICMP inspection is ...
Adam's user avatar
  • 353
19 votes
1 answer
4k views

Finding transparent firewall packet loss

We use the Cisco ASA 5585 in a layer2 transparent mode. The configuration is just two 10GE links between our business partner dmz and our inside network. A simple map looks like this. 10.4.2.9/30 ...
user2096's user avatar
  • 285
15 votes
4 answers
37k views

Finding IP Addresses for Social Network Sites

How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
pjf's user avatar
  • 253
15 votes
3 answers
7k views

Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation

I am in the middle of a project to migrate some existing switched ethernet dot1q trunks behind an ASA firewall... these trunks have five vlans each (numbered 51 - 55). This is a simple drawing of the ...
Mike Pennington's user avatar
11 votes
1 answer
602 views

Is a FIN only segment legal?

It would be convenient to mark TCP segments with just the FIN flag set, as an intrusion (without tracking the reply). I have always assumed that a FIN without an ACK, while rude and rare, is legal, ...
fundagain's user avatar
  • 169
11 votes
2 answers
6k views

Cisco ASA double NAT with DNS translation

I'm trying to set up double Auto NAT with DNS translation on Cisco ASA 9.0(3), and I'm having a few challenges with the DNS portion. I got double NAT working correctly, such that I have a server in ...
Mike Pennington's user avatar
11 votes
2 answers
4k views

Trying to fit centralised firewall into network topology

I'm in the process of over-hauling our network, the issue I keep coming back to is: trying to bring layer 3 to the core, while still having a centralised firewall. The main issue I have here is that ...
Geekman's user avatar
  • 1,478
10 votes
1 answer
554 views

Does L-ASA-SC-10= require a reboot?

We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall. Over time, we have been adding to this solution, and we're about to ...
user2578997's user avatar
9 votes
4 answers
15k views

How would a firewall kill a TCP connection without RST or FIN? [closed]

Situation is like this: http client ----> corporate firewall ----> http server Due to a keepalive, server and client would keep TCP connections open and the client would use a connection pool ...
cen's user avatar
  • 191
9 votes
2 answers
12k views

How do you throttle Dropbox Traffic?

It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com Since there are a lot of web services that rely on AmazonAWS, I cannot just ...
Blake's user avatar
  • 922
9 votes
2 answers
11k views

Cisco ASA Routing Issue

I am working on a lab right now and am having some issues with ASA routing. Here is the current network topology: Currently if I login to the console on the ASA or Router I can get outside to the ...
thefiddler's user avatar
9 votes
2 answers
9k views

load-balancing difference between DNS and IP - forwarding vs redirecting

I have come across a situation that I cannot understand. We have a Fortigate firewall that we have enabled to do load-balancing across two back-end Apache web servers. A DNS name is then mapped to ...
Yusuf's user avatar
  • 187
9 votes
1 answer
3k views

How does NAT Stitching work?

While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching. I understand Flow Stitching which join same type of inbound and outbound connection. But can't find anything ...
arif's user avatar
  • 613
9 votes
1 answer
3k views

Juniper SRX HA links passing through switch

it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples. Please , help to define correct choice and describe what the ...
Vitaliy's user avatar
  • 397
9 votes
2 answers
13k views

Find idle connections in Check Point firewall

I have a firewall, where I have to lower the TCP session timeout from 24h to 1h. Before I do that, I'm trying to determine if this will break any applications, i.e applications that have sessions that ...
sk0yern's user avatar
  • 195
8 votes
1 answer
12k views

Cisco ASA - Delete or rename "names"

I had a bad experience with Cisco ASA when changing/renaming "nameif" interface attributes. I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to ...
laf's user avatar
  • 795
8 votes
1 answer
2k views

ASA5550 Error: assertion "_vf_mode_init" failed: file "vf_api.c", line 99

I pulled an old ASA5550 off the shelf, which had 8.4(2) loaded on it. When I tried to boot it, I got the following error... ----------------------------------------------- Traceback output aborted. ...
Mike Pennington's user avatar
8 votes
2 answers
5k views

ASA in multiple context: save config

I have an ASA running 9.0(1) with four security contexts. When we modify a context, our standard procedure is to do a "write mem" inside that context. But sometimes we have to modify all the ...
Nachos's user avatar
  • 267
8 votes
1 answer
3k views

Cannot Load Internal Website over MPLS

We have an MPLS set up between two subnets. Everything (that is, I have RDP both directions as well as file-sharing) seems to be working correctly except for two things, which may be related. ...
bgmCoder's user avatar
  • 275
8 votes
3 answers
4k views

Cisco WLC: Per user authentication, many Vlans, few SSIDs

We have a simple problem. We want to restrict our wireless users to certain business websites based on their username when they login. We have many kinds of wireless devices: voip phones, cell phone,...
user2631's user avatar
8 votes
1 answer
3k views

How does group-policy inheritance work for a Cisco ASA?

I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure. What I really want to know is if I pull an attribute from a group-policy will it then be ...
evolvd's user avatar
  • 754
8 votes
1 answer
1k views

FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA

Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
A L's user avatar
  • 3,310
7 votes
3 answers
70k views

How to know at what OSI Layer(s) does a firewall operate

I understand that Firewalls may operate on different OSI layers depends on the firewall itself. but how can I know if I install specific firewall at what OSI Layer(s) it does operate ?
basma's user avatar
  • 91
7 votes
6 answers
2k views

Users want to work remotely, but need to use the same LAN IP addresses

I have users that need to be able to work remotely. In their current environment they use workstations with unique software that requires their IP address remain the same. Now that they are working ...
raidORlostark's user avatar
7 votes
4 answers
14k views

TCP Handshake fails on Cisco ASA

I am using a Traffic Generator for setting up a TCP connection that should pass a Cisco ASA firewall. My topology looks like this: +------------------+ ...
muehsi's user avatar
  • 347
7 votes
2 answers
14k views

Cannot get Cisco-ASA 5505 properly configured

I have been at this for 2 days, been through countless forums and tutorials as far as configuring my ASA-5505. I can't get out to the internet (even using ping from the ASA), I can't "see" the ASA on ...
Zak's user avatar
  • 463
7 votes
2 answers
12k views

ASA IPS issue: routing and management interface

We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
Эдуард Буремный's user avatar
7 votes
3 answers
2k views

Creating a JunOS firewall filter based on dynamic routing properties

One of my BGP transit customers has asked me for a solution to make it easier for him to blackhole traffic within our network when he's suffering from DDoS attacks. Usually, BGP blackholing is done by ...
Teun Vink's user avatar
  • 17k
7 votes
3 answers
18k views

Routing traffic between two subnets

I currently admin a small network, it has two separate sites (site1 site2). Each site has independent internet, and a Sonic NSA 220 Firewall. There is currently VPN connecting the two Sonic firewalls, ...
Imagine That's user avatar
6 votes
2 answers
4k views

Switchport BPDUs dropped at ASA firewall

I have stacked 2960X switches trunked to a single ASA 5515X in routed mode, and I've captured the drops with capture voip type asp-drop l2_acl after seeing the l2_acl counter incrementing in show asp ...
generalnetworkerror's user avatar
6 votes
1 answer
4k views

Traceroute to an internet address when I'm behind a Dynamic-PAT firewall?

Consider this network diagram: In this scenario, the router is performing "Dynamic PAT" (I'm using Cisco's definition) where all "real" or "inside" addresses are mapped to a single outside address ...
alx9r's user avatar
  • 904
6 votes
6 answers
2k views

Monitoring Network Traffic

I currently make use of a NETGEAR FVS338 firewall and a NETGEAR 24 port switch. Is there a way to graphically or in some way monitor their traffic? Edit: Switch Model FS726T
Jason Pass's user avatar
6 votes
1 answer
3k views

The use of DMZ and single firewall design

Apologies in advance if this is a stupid question. I have just started exploring network designs and firewalls. I have come across a network design where there is single firewall between internet, ...
DefenderAtkins's user avatar
6 votes
2 answers
2k views

What is distributed firewall?

What is distributed firewall? What are the problems associated with conventional firewall that gave rise to distributed firewall? Are there any kind of attacks that can be prevented by using ...
user3250183's user avatar
6 votes
1 answer
647 views

Can I use a reflexive ACL in place of a Firewall?

I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall. This was a LAB router that I would like to set ...
Jake Nelson's user avatar
6 votes
3 answers
426 views

Cisco ASA 5510 - ACL Config Question

My company's email server is under attack from the following IP address blocks 92.63.193.0 5.188.9.0 Here are the corresponding WHOIS records for each network % This is the RIPE Database query ...
Richie086's user avatar
  • 243
6 votes
1 answer
15k views

How to use tcp-udp objects in a single ACL?

I have a service object group of type 'tcp-udp'. When creating an ACL based around this, I don't have the option of type 'tcp-udp'. I'm trying to figure out what the point of tcp-udp groups are, if ...
A L's user avatar
  • 3,310
6 votes
1 answer
420 views

Is it possible to have ranges in two octets in an ACL / object-group

I'm trying to find out if there is a "clean" way to do this. I need to setup a ACL on a FWSM that effects devices over multiple subnets. The structure looks like this: 10.10.1-254.1-15 I could do: ...
evolvd's user avatar
  • 754
6 votes
1 answer
8k views

Cisco ASA cannot get "inside" vlan to internet through "outside" vlan

I just got my outside vlan configured up-and-running See Post Here. I was able to get vlan 2 pinging to the internet 8.8.8.8 specifically. However, now I honestly think I am misunderstanding what ...
Zak's user avatar
  • 463
6 votes
1 answer
2k views

How can the SIP timeout on a Cisco PIX be increased for the REGISTER transaction type?

A client app that registers through a PIX to a 3rd party SIP provider shows a 0:03:00 timeout. The client automatically reregisters every 5 minutes and doesn't appear configurable. After 3 minutes, ...
generalnetworkerror's user avatar
6 votes
1 answer
5k views

Cisco ASA: which side is "inside" with same security-level?

I have an issue with an FWSM apparently killing RDP sessions after a random amount of time, and the log entry looks like: Teardown TCP connection 145379776990678860 for MS_LZ1:10.30.3.150/49924 to ...
AnotherHowie's user avatar
6 votes
2 answers
3k views

VRFs to address asymmetric routing with stateful inspection

For branch offices with dual routers and WAN connections asymmetric routing causes issues with stateful packet inspection. Packets leaving through one router and returning through the other are ...
Stephen Craven's user avatar
6 votes
2 answers
5k views

Fortigate 100D internet on VLAN wan port

I am fairly new towards Fortigate firewalls and I am trying to set up one FortiGate 100D running firmware v5.0 as a router for a hotel network. I have 2 ISPs using PPPoE connection that runs on VLAN ...
Kenny Yap's user avatar
6 votes
2 answers
1k views

SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ

I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine. Now, I need to route one of the WAN IP ...
slartibartfast's user avatar
5 votes
4 answers
757 views

How risky is a personal-use-only wireless subnet inside the corporate subnet?

My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data ...
Logical Fallacy's user avatar
5 votes
3 answers
5k views

How does Deep Packet Inspection work with encrypted packets?

I've been reading up on Deep Packet Inspection for Software Defined Networks. However, I know that some applications use encryption to evade Deep Packet Inspection. Is there any alternative (such as ...
boomselector's user avatar
5 votes
3 answers
3k views

Difference between firewall and ACL

I have found many answers to this question, none of which satisfy me due to lack of detail. Can someone please explain in detail what is a firewall and what is its purpose, and what is an ACL and what ...
GalSuchetzky's user avatar
5 votes
3 answers
293 views

Are VPN Routers the same as a Router

I'm currently looking at the Cisco RV042 VPN router, and I am wondering if I will be able to setup individual networks with it. How do I know which routers or firewalls are capable of setting up ...
Jason's user avatar
  • 1,015
5 votes
7 answers
22k views

How I can block Psiphon?

I have a Sonicwall firewall. I want to block the Psiphon mobile and PC applications. I denied access on these ports: 51,5242,4244,5243,9785,1701,47,443,500,4500,1080 Most VPNs are closed but the ...
Hani's user avatar
  • 51
5 votes
1 answer
5k views

https url filtering on Cisco ASA 5520

I'm aware that you can use the ASA's URL filtering to filter URLs being accessed with regular expressions, but I'm curious if there is a way to filter which URLs can be accessed from the Internet to ...
David Rediger's user avatar

1
2 3 4 5
12