Questions tagged [firewall]
For questions about or relating to firewall operations, configuration and troubleshooting.
594
questions
25
votes
1
answer
918
views
Should IPv4 ICMP from untrusted interfaces be blocked?
Searching around I haven't been able to determine the best practice for ICMP on a firewall.
For example on a Cisco ASA would it be safe and recommended to allow ICMP from any if ICMP inspection is ...
- 353
19
votes
1
answer
4k
views
Finding transparent firewall packet loss
We use the Cisco ASA 5585 in a layer2 transparent mode. The configuration is just two 10GE links between our business partner dmz and our inside network. A simple map looks like this.
10.4.2.9/30 ...
- 285
15
votes
4
answers
37k
views
Finding IP Addresses for Social Network Sites
How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
- 253
15
votes
3
answers
7k
views
Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation
I am in the middle of a project to migrate some existing switched ethernet dot1q trunks behind an ASA firewall... these trunks have five vlans each (numbered 51 - 55). This is a simple drawing of the ...
- 29.9k
11
votes
1
answer
602
views
Is a FIN only segment legal?
It would be convenient to mark TCP segments with just the FIN flag set, as an intrusion (without tracking the reply).
I have always assumed that a FIN without an ACK, while rude and rare, is legal, ...
- 169
11
votes
2
answers
6k
views
Cisco ASA double NAT with DNS translation
I'm trying to set up double Auto NAT with DNS translation on Cisco ASA 9.0(3), and I'm having a few challenges with the DNS portion. I got double NAT working correctly, such that I have a server in ...
- 29.9k
11
votes
2
answers
4k
views
Trying to fit centralised firewall into network topology
I'm in the process of over-hauling our network, the issue I keep coming back to is: trying to bring layer 3 to the core, while still having a centralised firewall.
The main issue I have here is that ...
- 1,478
10
votes
1
answer
554
views
Does L-ASA-SC-10= require a reboot?
We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall. Over time, we have been adding to this solution, and we're about to ...
- 103
9
votes
4
answers
15k
views
How would a firewall kill a TCP connection without RST or FIN? [closed]
Situation is like this:
http client ----> corporate firewall ----> http server
Due to a keepalive, server and client would keep TCP connections open and the client would use a connection pool ...
- 191
9
votes
2
answers
12k
views
How do you throttle Dropbox Traffic?
It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com
Since there are a lot of web services that rely on AmazonAWS, I cannot just ...
- 922
9
votes
2
answers
11k
views
Cisco ASA Routing Issue
I am working on a lab right now and am having some issues with ASA routing.
Here is the current network topology:
Currently if I login to the console on the ASA or Router I can get outside to the ...
- 345
9
votes
2
answers
9k
views
load-balancing difference between DNS and IP - forwarding vs redirecting
I have come across a situation that I cannot understand. We have a Fortigate firewall that we have enabled to do load-balancing across two back-end Apache web servers. A DNS name is then mapped to ...
- 187
9
votes
1
answer
3k
views
How does NAT Stitching work?
While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching.
I understand Flow Stitching which join same type of inbound and outbound connection.
But can't find anything ...
- 613
9
votes
1
answer
3k
views
Juniper SRX HA links passing through switch
it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples.
Please , help to define correct choice and describe what the ...
- 397
9
votes
2
answers
13k
views
Find idle connections in Check Point firewall
I have a firewall, where I have to lower the TCP session timeout from 24h to 1h.
Before I do that, I'm trying to determine if this will break any applications, i.e applications that have sessions that ...
- 195
8
votes
1
answer
12k
views
Cisco ASA - Delete or rename "names"
I had a bad experience with Cisco ASA when changing/renaming "nameif" interface attributes.
I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to ...
- 795
8
votes
1
answer
2k
views
ASA5550 Error: assertion "_vf_mode_init" failed: file "vf_api.c", line 99
I pulled an old ASA5550 off the shelf, which had 8.4(2) loaded on it. When I tried to boot it, I got the following error...
-----------------------------------------------
Traceback output aborted.
...
- 29.9k
8
votes
2
answers
5k
views
ASA in multiple context: save config
I have an ASA running 9.0(1) with four security contexts. When we modify a context, our standard procedure is to do a "write mem" inside that context. But sometimes we have to modify all the ...
- 267
8
votes
1
answer
3k
views
Cannot Load Internal Website over MPLS
We have an MPLS set up between two subnets. Everything (that is, I have RDP both directions as well as file-sharing) seems to be working correctly except for two things, which may be related.
...
- 275
8
votes
3
answers
4k
views
Cisco WLC: Per user authentication, many Vlans, few SSIDs
We have a simple problem. We want to restrict our wireless users to certain business websites based on their username when they login. We have many kinds of wireless devices: voip phones, cell phone,...
- 81
8
votes
1
answer
3k
views
How does group-policy inheritance work for a Cisco ASA?
I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure.
What I really want to know is if I pull an attribute from a group-policy will it then be ...
- 754
8
votes
1
answer
1k
views
FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA
Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
- 3,310
7
votes
3
answers
70k
views
How to know at what OSI Layer(s) does a firewall operate
I understand that Firewalls may operate on different OSI layers depends on the firewall itself.
but how can I know if I install specific firewall at what OSI Layer(s) it does operate ?
- 91
7
votes
6
answers
2k
views
Users want to work remotely, but need to use the same LAN IP addresses
I have users that need to be able to work remotely. In their current environment they use workstations with unique software that requires their IP address remain the same. Now that they are working ...
- 327
7
votes
4
answers
14k
views
TCP Handshake fails on Cisco ASA
I am using a Traffic Generator for setting up a TCP connection that should pass a Cisco ASA firewall.
My topology looks like this:
+------------------+
...
- 347
7
votes
2
answers
14k
views
Cannot get Cisco-ASA 5505 properly configured
I have been at this for 2 days, been through countless forums and tutorials as far as configuring my ASA-5505. I can't get out to the internet (even using ping from the ASA), I can't "see" the ASA on ...
- 463
7
votes
2
answers
12k
views
ASA IPS issue: routing and management interface
We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
- 831
7
votes
3
answers
2k
views
Creating a JunOS firewall filter based on dynamic routing properties
One of my BGP transit customers has asked me for a solution to make it easier for him to blackhole traffic within our network when he's suffering from DDoS attacks. Usually, BGP blackholing is done by ...
- 17k
7
votes
3
answers
18k
views
Routing traffic between two subnets
I currently admin a small network, it has two separate sites (site1 site2). Each site has independent internet, and a Sonic NSA 220 Firewall. There is currently VPN connecting the two Sonic firewalls, ...
- 73
6
votes
2
answers
4k
views
Switchport BPDUs dropped at ASA firewall
I have stacked 2960X switches trunked to a single ASA 5515X in routed mode, and I've captured the drops with capture voip type asp-drop l2_acl after seeing the l2_acl counter incrementing in show asp ...
- 7,094
6
votes
1
answer
4k
views
Traceroute to an internet address when I'm behind a Dynamic-PAT firewall?
Consider this network diagram:
In this scenario, the router is performing "Dynamic PAT" (I'm using Cisco's definition) where all "real" or "inside" addresses are mapped to a single outside address ...
- 904
6
votes
6
answers
2k
views
Monitoring Network Traffic
I currently make use of a NETGEAR FVS338 firewall and a NETGEAR 24 port switch. Is there a way to graphically or in some way monitor their traffic?
Edit: Switch Model FS726T
- 223
6
votes
1
answer
3k
views
The use of DMZ and single firewall design
Apologies in advance if this is a stupid question. I have just started exploring network designs and firewalls.
I have come across a network design where there is single firewall between internet, ...
6
votes
2
answers
2k
views
What is distributed firewall?
What is distributed firewall? What are the problems associated with conventional firewall that gave rise to distributed firewall? Are there any kind of attacks that can be prevented by using ...
- 161
6
votes
1
answer
647
views
Can I use a reflexive ACL in place of a Firewall?
I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall.
This was a LAB router that I would like to set ...
- 267
6
votes
3
answers
426
views
Cisco ASA 5510 - ACL Config Question
My company's email server is under attack from the following IP address blocks
92.63.193.0
5.188.9.0
Here are the corresponding WHOIS records for each network
% This is the RIPE Database query ...
- 243
6
votes
1
answer
15k
views
How to use tcp-udp objects in a single ACL?
I have a service object group of type 'tcp-udp'. When creating an ACL based around this, I don't have the option of type 'tcp-udp'. I'm trying to figure out what the point of tcp-udp groups are, if ...
- 3,310
6
votes
1
answer
420
views
Is it possible to have ranges in two octets in an ACL / object-group
I'm trying to find out if there is a "clean" way to do this.
I need to setup a ACL on a FWSM that effects devices over multiple subnets.
The structure looks like this:
10.10.1-254.1-15
I could do:
...
- 754
6
votes
1
answer
8k
views
Cisco ASA cannot get "inside" vlan to internet through "outside" vlan
I just got my outside vlan configured up-and-running See Post Here. I was able to get vlan 2 pinging to the internet 8.8.8.8 specifically. However, now I honestly think I am misunderstanding what ...
- 463
6
votes
1
answer
2k
views
How can the SIP timeout on a Cisco PIX be increased for the REGISTER transaction type?
A client app that registers through a PIX to a 3rd party SIP provider shows a 0:03:00 timeout. The client automatically reregisters every 5 minutes and doesn't appear configurable. After 3 minutes, ...
- 7,094
6
votes
1
answer
5k
views
Cisco ASA: which side is "inside" with same security-level?
I have an issue with an FWSM apparently killing RDP sessions after a random amount of time, and the log entry looks like:
Teardown TCP connection 145379776990678860 for MS_LZ1:10.30.3.150/49924 to ...
- 355
6
votes
2
answers
3k
views
VRFs to address asymmetric routing with stateful inspection
For branch offices with dual routers and WAN connections asymmetric routing causes issues with stateful packet inspection. Packets leaving through one router and returning through the other are ...
- 666
6
votes
2
answers
5k
views
Fortigate 100D internet on VLAN wan port
I am fairly new towards Fortigate firewalls and I am trying to set up one FortiGate 100D running firmware v5.0 as a router for a hotel network. I have 2 ISPs using PPPoE connection that runs on VLAN ...
- 61
6
votes
2
answers
1k
views
SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ
I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine.
Now, I need to route one of the WAN IP ...
5
votes
4
answers
757
views
How risky is a personal-use-only wireless subnet inside the corporate subnet?
My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data ...
- 153
5
votes
3
answers
5k
views
How does Deep Packet Inspection work with encrypted packets?
I've been reading up on Deep Packet Inspection for Software Defined Networks. However, I know that some applications use encryption to evade Deep Packet Inspection. Is there any alternative (such as ...
- 113
5
votes
3
answers
3k
views
Difference between firewall and ACL
I have found many answers to this question, none of which satisfy me due to lack of detail.
Can someone please explain in detail what is a firewall and what is its purpose, and what is an ACL and what ...
- 151
5
votes
3
answers
293
views
Are VPN Routers the same as a Router
I'm currently looking at the Cisco RV042 VPN router, and I am wondering if I will be able to setup individual networks with it.
How do I know which routers or firewalls are capable of setting up ...
- 1,015
5
votes
7
answers
22k
views
How I can block Psiphon?
I have a Sonicwall firewall. I want to block the Psiphon mobile and PC applications.
I denied access on these ports: 51,5242,4244,5243,9785,1701,47,443,500,4500,1080
Most VPNs are closed but the ...
- 51
5
votes
1
answer
5k
views
https url filtering on Cisco ASA 5520
I'm aware that you can use the ASA's URL filtering to filter URLs being accessed with regular expressions, but I'm curious if there is a way to filter which URLs can be accessed from the Internet to ...
- 257