Questions tagged [firewall]
For questions about or relating to firewall operations, configuration and troubleshooting.
548
questions
24
votes
1answer
798 views
Should IPv4 ICMP from untrusted interfaces be blocked?
Searching around I haven't been able to determine the best practice for ICMP on a firewall.
For example on a Cisco ASA would it be safe and recommended to allow ICMP from any if ICMP inspection is ...
19
votes
1answer
3k views
Finding transparent firewall packet loss
We use the Cisco ASA 5585 in a layer2 transparent mode. The configuration is just two 10GE links between our business partner dmz and our inside network. A simple map looks like this.
10.4.2.9/30 ...
15
votes
3answers
6k views
Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation
I am in the middle of a project to migrate some existing switched ethernet dot1q trunks behind an ASA firewall... these trunks have five vlans each (numbered 51 - 55). This is a simple drawing of the ...
14
votes
5answers
36k views
Finding IP Addresses for Social Network Sites
How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to ...
11
votes
1answer
409 views
Is a FIN only segment legal?
It would be convenient to mark TCP segments with just the FIN flag set, as an intrusion (without tracking the reply).
I have always assumed that a FIN without an ACK, while rude and rare, is legal, ...
11
votes
2answers
6k views
Cisco ASA double NAT with DNS translation
I'm trying to set up double Auto NAT with DNS translation on Cisco ASA 9.0(3), and I'm having a few challenges with the DNS portion. I got double NAT working correctly, such that I have a server in ...
11
votes
2answers
3k views
Trying to fit centralised firewall into network topology
I'm in the process of over-hauling our network, the issue I keep coming back to is: trying to bring layer 3 to the core, while still having a centralised firewall.
The main issue I have here is that ...
10
votes
1answer
523 views
Does L-ASA-SC-10= require a reboot?
We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall. Over time, we have been adding to this solution, and we're about to ...
9
votes
2answers
12k views
How do you throttle Dropbox Traffic?
It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com
Since there are a lot of web services that rely on AmazonAWS, I cannot just ...
9
votes
2answers
10k views
Cisco ASA Routing Issue
I am working on a lab right now and am having some issues with ASA routing.
Here is the current network topology:
Currently if I login to the console on the ASA or Router I can get outside to the ...
9
votes
2answers
8k views
load-balancing difference between DNS and IP - forwarding vs redirecting
I have come across a situation that I cannot understand. We have a Fortigate firewall that we have enabled to do load-balancing across two back-end Apache web servers. A DNS name is then mapped to ...
9
votes
1answer
2k views
How does NAT Stitching work?
While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching.
I understand Flow Stitching which join same type of inbound and outbound connection.
But can't find anything ...
9
votes
1answer
3k views
Juniper SRX HA links passing through switch
it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples.
Please , help to define correct choice and describe what the ...
9
votes
2answers
12k views
Find idle connections in Check Point firewall
I have a firewall, where I have to lower the TCP session timeout from 24h to 1h.
Before I do that, I'm trying to determine if this will break any applications, i.e applications that have sessions that ...
8
votes
4answers
13k views
How would a firewall kill a TCP connection without RST or FIN? [closed]
Situation is like this:
http client ----> corporate firewall ----> http server
Due to a keepalive, server and client would keep TCP connections open and the client would use a connection pool ...
8
votes
1answer
11k views
Cisco ASA - Delete or rename “names”
I had a bad experience with Cisco ASA when changing/renaming "nameif" interface attributes.
I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to ...
8
votes
1answer
2k views
ASA5550 Error: assertion “_vf_mode_init” failed: file “vf_api.c”, line 99
I pulled an old ASA5550 off the shelf, which had 8.4(2) loaded on it. When I tried to boot it, I got the following error...
-----------------------------------------------
Traceback output aborted.
...
8
votes
2answers
4k views
ASA in multiple context: save config
I have an ASA running 9.0(1) with four security contexts. When we modify a context, our standard procedure is to do a "write mem" inside that context. But sometimes we have to modify all the ...
8
votes
1answer
2k views
Cannot Load Internal Website over MPLS
We have an MPLS set up between two subnets. Everything (that is, I have RDP both directions as well as file-sharing) seems to be working correctly except for two things, which may be related.
...
8
votes
3answers
4k views
Cisco WLC: Per user authentication, many Vlans, few SSIDs
We have a simple problem. We want to restrict our wireless users to certain business websites based on their username when they login. We have many kinds of wireless devices: voip phones, cell phone,...
8
votes
1answer
3k views
How does group-policy inheritance work for a Cisco ASA?
I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure.
What I really want to know is if I pull an attribute from a group-policy will it then be ...
8
votes
1answer
1k views
FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA
Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
7
votes
6answers
2k views
Users want to work remotely, but need to use the same LAN IP addresses
I have users that need to be able to work remotely. In their current environment they use workstations with unique software that requires their IP address remain the same. Now that they are working ...
7
votes
4answers
12k views
TCP Handshake fails on Cisco ASA
I am using a Traffic Generator for setting up a TCP connection that should pass a Cisco ASA firewall.
My topology looks like this:
+------------------+
...
7
votes
2answers
14k views
Cannot get Cisco-ASA 5505 properly configured
I have been at this for 2 days, been through countless forums and tutorials as far as configuring my ASA-5505. I can't get out to the internet (even using ping from the ASA), I can't "see" the ASA on ...
7
votes
2answers
12k views
ASA IPS issue: routing and management interface
We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (...
7
votes
3answers
1k views
Creating a JunOS firewall filter based on dynamic routing properties
One of my BGP transit customers has asked me for a solution to make it easier for him to blackhole traffic within our network when he's suffering from DDoS attacks. Usually, BGP blackholing is done by ...
7
votes
3answers
17k views
Routing traffic between two subnets
I currently admin a small network, it has two separate sites (site1 site2). Each site has independent internet, and a Sonic NSA 220 Firewall. There is currently VPN connecting the two Sonic firewalls, ...
6
votes
2answers
3k views
Switchport BPDUs dropped at ASA firewall
I have stacked 2960X switches trunked to a single ASA 5515X in routed mode, and I've captured the drops with capture voip type asp-drop l2_acl after seeing the l2_acl counter incrementing in show asp ...
6
votes
1answer
4k views
Traceroute to an internet address when I'm behind a Dynamic-PAT firewall?
Consider this network diagram:
In this scenario, the router is performing "Dynamic PAT" (I'm using Cisco's definition) where all "real" or "inside" addresses are mapped to a single outside address ...
6
votes
6answers
2k views
Monitoring Network Traffic
I currently make use of a NETGEAR FVS338 firewall and a NETGEAR 24 port switch. Is there a way to graphically or in some way monitor their traffic?
Edit: Switch Model FS726T
6
votes
1answer
3k views
The use of DMZ and single firewall design
Apologies in advance if this is a stupid question. I have just started exploring network designs and firewalls.
I have come across a network design where there is single firewall between internet, ...
6
votes
2answers
2k views
What is distributed firewall?
What is distributed firewall? What are the problems associated with conventional firewall that gave rise to distributed firewall? Are there any kind of attacks that can be prevented by using ...
6
votes
1answer
556 views
Can I use a reflexive ACL in place of a Firewall?
I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall.
This was a LAB router that I would like to set ...
6
votes
3answers
370 views
Cisco ASA 5510 - ACL Config Question
My company's email server is under attack from the following IP address blocks
92.63.193.0
5.188.9.0
Here are the corresponding WHOIS records for each network
% This is the RIPE Database query ...
6
votes
1answer
14k views
How to use tcp-udp objects in a single ACL?
I have a service object group of type 'tcp-udp'. When creating an ACL based around this, I don't have the option of type 'tcp-udp'. I'm trying to figure out what the point of tcp-udp groups are, if ...
6
votes
1answer
401 views
Is it possible to have ranges in two octets in an ACL / object-group
I'm trying to find out if there is a "clean" way to do this.
I need to setup a ACL on a FWSM that effects devices over multiple subnets.
The structure looks like this:
10.10.1-254.1-15
I could do:
...
6
votes
1answer
8k views
Cisco ASA cannot get “inside” vlan to internet through “outside” vlan
I just got my outside vlan configured up-and-running See Post Here. I was able to get vlan 2 pinging to the internet 8.8.8.8 specifically. However, now I honestly think I am misunderstanding what ...
6
votes
1answer
2k views
How can the SIP timeout on a Cisco PIX be increased for the REGISTER transaction type?
A client app that registers through a PIX to a 3rd party SIP provider shows a 0:03:00 timeout. The client automatically reregisters every 5 minutes and doesn't appear configurable. After 3 minutes, ...
6
votes
1answer
5k views
Cisco ASA: which side is “inside” with same security-level?
I have an issue with an FWSM apparently killing RDP sessions after a random amount of time, and the log entry looks like:
Teardown TCP connection 145379776990678860 for MS_LZ1:10.30.3.150/49924 to ...
6
votes
2answers
3k views
VRFs to address asymmetric routing with stateful inspection
For branch offices with dual routers and WAN connections asymmetric routing causes issues with stateful packet inspection. Packets leaving through one router and returning through the other are ...
6
votes
2answers
4k views
Fortigate 100D internet on VLAN wan port
I am fairly new towards Fortigate firewalls and I am trying to set up one FortiGate 100D running firmware v5.0 as a router for a hotel network. I have 2 ISPs using PPPoE connection that runs on VLAN ...
5
votes
4answers
741 views
How risky is a personal-use-only wireless subnet inside the corporate subnet?
My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data ...
5
votes
3answers
62k views
How to know at what OSI Layer(s) does a firewall operate
I understand that Firewalls may operate on different OSI layers depends on the firewall itself.
but how can I know if I install specific firewall at what OSI Layer(s) it does operate ?
5
votes
3answers
275 views
Are VPN Routers the same as a Router
I'm currently looking at the Cisco RV042 VPN router, and I am wondering if I will be able to setup individual networks with it.
How do I know which routers or firewalls are capable of setting up ...
5
votes
1answer
5k views
https url filtering on Cisco ASA 5520
I'm aware that you can use the ASA's URL filtering to filter URLs being accessed with regular expressions, but I'm curious if there is a way to filter which URLs can be accessed from the Internet to ...
5
votes
1answer
606 views
Filter by TCP Flag ASA
In a standard Cisco 3600 router, I am able to apply TCP flag filtering to an extended access list:
R1#configure terminal
R1(config)#ip access-list extended 101
R1(config-ext-nacl)#
From here,
R1(...
5
votes
1answer
245 views
Where to put dedicated firewall for two departments separated by their own access switches and connected through a same distribution switch?
Based on network design model proposed by Cisco, the firewall is for traffic to/from internet and there is no dedicated firewall for traffic to/from intranet. Is firewall on distribution switch is ...
5
votes
1answer
179 views
Connecting a firewall cluster to other appliance cluster
I have a network design with two NSA firewall clustered in HA mode and two SRA appliance also clustered in HA. My first approach for network design was this:
NSA1-HA-NSA2
| |
| |
| ...
5
votes
2answers
16k views
pfSense 2.3 How to setup each Lan traffic goes only over specific gateway
I am running a pfSense 2.3 box with 4 NICs. Now i have 2 different ISPs (one Cable & one DSL). How Can i configure, that all traffic from LAN1 goes ONLY over WAN1, and all traffic from LAN2 goes ...
