Questions tagged [firewall]

For questions about or relating to firewall operations, configuration and troubleshooting.

Filter by
Sorted by
Tagged with
24
votes
1answer
798 views

Should IPv4 ICMP from untrusted interfaces be blocked?

Searching around I haven't been able to determine the best practice for ICMP on a firewall. For example on a Cisco ASA would it be safe and recommended to allow ICMP from any if ICMP inspection is ...
19
votes
1answer
3k views

Finding transparent firewall packet loss

We use the Cisco ASA 5585 in a layer2 transparent mode. The configuration is just two 10GE links between our business partner dmz and our inside network. A simple map looks like this. 10.4.2.9/30 ...
15
votes
3answers
6k views

Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation

I am in the middle of a project to migrate some existing switched ethernet dot1q trunks behind an ASA firewall... these trunks have five vlans each (numbered 51 - 55). This is a simple drawing of the ...
14
votes
5answers
36k views

Finding IP Addresses for Social Network Sites

How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
11
votes
1answer
409 views

Is a FIN only segment legal?

It would be convenient to mark TCP segments with just the FIN flag set, as an intrusion (without tracking the reply). I have always assumed that a FIN without an ACK, while rude and rare, is legal, ...
11
votes
2answers
6k views

Cisco ASA double NAT with DNS translation

I'm trying to set up double Auto NAT with DNS translation on Cisco ASA 9.0(3), and I'm having a few challenges with the DNS portion. I got double NAT working correctly, such that I have a server in ...
11
votes
2answers
3k views

Trying to fit centralised firewall into network topology

I'm in the process of over-hauling our network, the issue I keep coming back to is: trying to bring layer 3 to the core, while still having a centralised firewall. The main issue I have here is that ...
10
votes
1answer
523 views

Does L-ASA-SC-10= require a reboot?

We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall. Over time, we have been adding to this solution, and we're about to ...
9
votes
2answers
12k views

How do you throttle Dropbox Traffic?

It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com Since there are a lot of web services that rely on AmazonAWS, I cannot just ...
9
votes
2answers
10k views

Cisco ASA Routing Issue

I am working on a lab right now and am having some issues with ASA routing. Here is the current network topology: Currently if I login to the console on the ASA or Router I can get outside to the ...
9
votes
2answers
8k views

load-balancing difference between DNS and IP - forwarding vs redirecting

I have come across a situation that I cannot understand. We have a Fortigate firewall that we have enabled to do load-balancing across two back-end Apache web servers. A DNS name is then mapped to ...
9
votes
1answer
2k views

How does NAT Stitching work?

While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching. I understand Flow Stitching which join same type of inbound and outbound connection. But can't find anything ...
9
votes
1answer
3k views

Juniper SRX HA links passing through switch

it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples. Please , help to define correct choice and describe what the ...
9
votes
2answers
12k views

Find idle connections in Check Point firewall

I have a firewall, where I have to lower the TCP session timeout from 24h to 1h. Before I do that, I'm trying to determine if this will break any applications, i.e applications that have sessions that ...
8
votes
4answers
13k views

How would a firewall kill a TCP connection without RST or FIN? [closed]

Situation is like this: http client ----> corporate firewall ----> http server Due to a keepalive, server and client would keep TCP connections open and the client would use a connection pool ...
8
votes
1answer
11k views

Cisco ASA - Delete or rename “names”

I had a bad experience with Cisco ASA when changing/renaming "nameif" interface attributes. I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to ...
8
votes
1answer
2k views

ASA5550 Error: assertion “_vf_mode_init” failed: file “vf_api.c”, line 99

I pulled an old ASA5550 off the shelf, which had 8.4(2) loaded on it. When I tried to boot it, I got the following error... ----------------------------------------------- Traceback output aborted. ...
8
votes
2answers
4k views

ASA in multiple context: save config

I have an ASA running 9.0(1) with four security contexts. When we modify a context, our standard procedure is to do a "write mem" inside that context. But sometimes we have to modify all the ...
8
votes
1answer
2k views

Cannot Load Internal Website over MPLS

We have an MPLS set up between two subnets. Everything (that is, I have RDP both directions as well as file-sharing) seems to be working correctly except for two things, which may be related. ...
8
votes
3answers
4k views

Cisco WLC: Per user authentication, many Vlans, few SSIDs

We have a simple problem. We want to restrict our wireless users to certain business websites based on their username when they login. We have many kinds of wireless devices: voip phones, cell phone,...
8
votes
1answer
3k views

How does group-policy inheritance work for a Cisco ASA?

I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure. What I really want to know is if I pull an attribute from a group-policy will it then be ...
8
votes
1answer
1k views

FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA

Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
7
votes
6answers
2k views

Users want to work remotely, but need to use the same LAN IP addresses

I have users that need to be able to work remotely. In their current environment they use workstations with unique software that requires their IP address remain the same. Now that they are working ...
7
votes
4answers
12k views

TCP Handshake fails on Cisco ASA

I am using a Traffic Generator for setting up a TCP connection that should pass a Cisco ASA firewall. My topology looks like this: +------------------+ ...
7
votes
2answers
14k views

Cannot get Cisco-ASA 5505 properly configured

I have been at this for 2 days, been through countless forums and tutorials as far as configuring my ASA-5505. I can't get out to the internet (even using ping from the ASA), I can't "see" the ASA on ...
7
votes
2answers
12k views

ASA IPS issue: routing and management interface

We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
7
votes
3answers
1k views

Creating a JunOS firewall filter based on dynamic routing properties

One of my BGP transit customers has asked me for a solution to make it easier for him to blackhole traffic within our network when he's suffering from DDoS attacks. Usually, BGP blackholing is done by ...
7
votes
3answers
17k views

Routing traffic between two subnets

I currently admin a small network, it has two separate sites (site1 site2). Each site has independent internet, and a Sonic NSA 220 Firewall. There is currently VPN connecting the two Sonic firewalls, ...
6
votes
2answers
3k views

Switchport BPDUs dropped at ASA firewall

I have stacked 2960X switches trunked to a single ASA 5515X in routed mode, and I've captured the drops with capture voip type asp-drop l2_acl after seeing the l2_acl counter incrementing in show asp ...
6
votes
1answer
4k views

Traceroute to an internet address when I'm behind a Dynamic-PAT firewall?

Consider this network diagram: In this scenario, the router is performing "Dynamic PAT" (I'm using Cisco's definition) where all "real" or "inside" addresses are mapped to a single outside address ...
6
votes
6answers
2k views

Monitoring Network Traffic

I currently make use of a NETGEAR FVS338 firewall and a NETGEAR 24 port switch. Is there a way to graphically or in some way monitor their traffic? Edit: Switch Model FS726T
6
votes
1answer
3k views

The use of DMZ and single firewall design

Apologies in advance if this is a stupid question. I have just started exploring network designs and firewalls. I have come across a network design where there is single firewall between internet, ...
6
votes
2answers
2k views

What is distributed firewall?

What is distributed firewall? What are the problems associated with conventional firewall that gave rise to distributed firewall? Are there any kind of attacks that can be prevented by using ...
6
votes
1answer
556 views

Can I use a reflexive ACL in place of a Firewall?

I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall. This was a LAB router that I would like to set ...
6
votes
3answers
370 views

Cisco ASA 5510 - ACL Config Question

My company's email server is under attack from the following IP address blocks 92.63.193.0 5.188.9.0 Here are the corresponding WHOIS records for each network % This is the RIPE Database query ...
6
votes
1answer
14k views

How to use tcp-udp objects in a single ACL?

I have a service object group of type 'tcp-udp'. When creating an ACL based around this, I don't have the option of type 'tcp-udp'. I'm trying to figure out what the point of tcp-udp groups are, if ...
6
votes
1answer
401 views

Is it possible to have ranges in two octets in an ACL / object-group

I'm trying to find out if there is a "clean" way to do this. I need to setup a ACL on a FWSM that effects devices over multiple subnets. The structure looks like this: 10.10.1-254.1-15 I could do: ...
6
votes
1answer
8k views

Cisco ASA cannot get “inside” vlan to internet through “outside” vlan

I just got my outside vlan configured up-and-running See Post Here. I was able to get vlan 2 pinging to the internet 8.8.8.8 specifically. However, now I honestly think I am misunderstanding what ...
6
votes
1answer
2k views

How can the SIP timeout on a Cisco PIX be increased for the REGISTER transaction type?

A client app that registers through a PIX to a 3rd party SIP provider shows a 0:03:00 timeout. The client automatically reregisters every 5 minutes and doesn't appear configurable. After 3 minutes, ...
6
votes
1answer
5k views

Cisco ASA: which side is “inside” with same security-level?

I have an issue with an FWSM apparently killing RDP sessions after a random amount of time, and the log entry looks like: Teardown TCP connection 145379776990678860 for MS_LZ1:10.30.3.150/49924 to ...
6
votes
2answers
3k views

VRFs to address asymmetric routing with stateful inspection

For branch offices with dual routers and WAN connections asymmetric routing causes issues with stateful packet inspection. Packets leaving through one router and returning through the other are ...
6
votes
2answers
4k views

Fortigate 100D internet on VLAN wan port

I am fairly new towards Fortigate firewalls and I am trying to set up one FortiGate 100D running firmware v5.0 as a router for a hotel network. I have 2 ISPs using PPPoE connection that runs on VLAN ...
5
votes
4answers
741 views

How risky is a personal-use-only wireless subnet inside the corporate subnet?

My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data ...
5
votes
3answers
62k views

How to know at what OSI Layer(s) does a firewall operate

I understand that Firewalls may operate on different OSI layers depends on the firewall itself. but how can I know if I install specific firewall at what OSI Layer(s) it does operate ?
5
votes
3answers
275 views

Are VPN Routers the same as a Router

I'm currently looking at the Cisco RV042 VPN router, and I am wondering if I will be able to setup individual networks with it. How do I know which routers or firewalls are capable of setting up ...
5
votes
1answer
5k views

https url filtering on Cisco ASA 5520

I'm aware that you can use the ASA's URL filtering to filter URLs being accessed with regular expressions, but I'm curious if there is a way to filter which URLs can be accessed from the Internet to ...
5
votes
1answer
606 views

Filter by TCP Flag ASA

In a standard Cisco 3600 router, I am able to apply TCP flag filtering to an extended access list: R1#configure terminal R1(config)#ip access-list extended 101 R1(config-ext-nacl)# From here, R1(...
5
votes
1answer
245 views

Where to put dedicated firewall for two departments separated by their own access switches and connected through a same distribution switch?

Based on network design model proposed by Cisco, the firewall is for traffic to/from internet and there is no dedicated firewall for traffic to/from intranet. Is firewall on distribution switch is ...
5
votes
1answer
179 views

Connecting a firewall cluster to other appliance cluster

I have a network design with two NSA firewall clustered in HA mode and two SRA appliance also clustered in HA. My first approach for network design was this: NSA1-HA-NSA2 | | | | | ...
5
votes
2answers
16k views

pfSense 2.3 How to setup each Lan traffic goes only over specific gateway

I am running a pfSense 2.3 box with 4 NICs. Now i have 2 different ISPs (one Cable & one DSL). How Can i configure, that all traffic from LAN1 goes ONLY over WAN1, and all traffic from LAN2 goes ...

1
2 3 4 5
11