14
All the research of half an hour says that FIN-only is never legitimate.
http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html
Packets should never contain just a FIN flag. FIN packets are
frequently used for port scans, network mapping and other stealth
activities.
https://lists.sans.org/pipermail/list/2006-June/...
answered Aug 25 '18 at 13:01
Marc 'netztier' Luethi
7,4821 gold badge10 silver badges27 bronze badges
13
Best practice wise - should I let the router or the ASA handle NAT
(Overloading)?
In the most general of design best practices NAT is performed between an inside and outside network. NAT overloading is generally performed at the edge when there is limited public IP address space. You can learn more about NAT overloading, also known as Port Address ...
13
Since firewalls essentially filter data, the answer depends on what kind of filtering you do.
If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. If you filter specific ports, you can say you're filtering at layer 4. If your firewall inspects specific protocol states or data, you can say it operates at ...
12
Yes, you're missing something. And yes, "something fancy" is going on. The router's NAT state table will map the inside-outside translation for the traceroute probe. (UDP normally) As is required for ICMP to work through any firewall, an ICMP error message will be allowed as part of an established flow. The "fancy" part is the fact the ICMP error carries ...
12
You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can present a distorted view of your flows.
As Cisco explains it, NAT stitching will stitch the (apparently) separate flows to give you the single flow view:
...
11
Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches:
Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure.
set interface x mtu 9216
...
11
You don't mention the kind of firewall, but I suspect most simply drop the packets.
I have a Wireshark dump on server side and I tried to find if firewall
sends a FIN or RST with ip.dst==serverip && (tcp.flags.reset==1 ||
tcp.flags.fin==1) but nothing showed up.
Which would tend to confirm this.
10
The ASA5550 requires the SSM-4GE-INC module to be plugged into the chassis1 when it is booted; if it is not, then you get assertion "_vf_mode_init" failed: file "vf_api.c", line 99 printed to the console.
I discovered this2 after opening a case with TAC (who did not catch this problem), RMA'ing the original chassis, and then unplugging the SSM-4GE-INC ...
9
The two Windstream Routers each have an MPLS port:
192.168.1.2 = Host MPLS
192.168.2.2 = Remote MPLS
The Windstream routers also each have an open internet port to which I have attached a Firewall Router for filtering the internet, making the internet gateways:
192.168.1.1 = Host Gateway
192.168.2.1 = Remote Gateway
Problem ...
9
As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does tend to "cripple" their functionality in many ways.
The new trend in security of this type is Network Traffic Analysis (NTA). Just as many companies are far less ...
8
Answering my own question to help future googlers. I spent about 3 hours on the phone with TAC; we finally got to the root cause of the issue.
The solution is to add a special NAT entry, which matches the IP address in the DNS A-Record when it arrives on the INSIDE interface.
object network DNS_NAT_masd1
description xlate A-Record DMZ src 1.195.18.182 to ...
8
If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s?
This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to be.
So for things like switches that may be entirely processed in hardware, this could be more than a million pps. For a router, this may be lower. For a ...
7
Generally speaking, the direction of the traffic is determined by the location of the host establishing the connection.
In your example, as you indicated, the original VPN connection (#1) is inbound because the traffic originates at a host outside the network which establishes a connection to an internal resource.
Once this connection is established (#2), ...
7
The "outside" vlan seems to be misconfigured, and I've tried so many permeations, that I am sure I am overlooking something major, and obvious. When I am able to ping 8.8.8.8, from the ASA, I'll be happy!
Basic Config
As others have mentioned, your configuration is "suboptimal"... the biggest problem you have is that you're not using DHCP on the outside ...
7
You are correct, if all the ASA sees is an HTTPS request, then the TCP payload is encrypted, which prevents the ASA's URL filtering (or any other TCP payload inspection).
Typically, url filtering is done by an http reverse-proxy or load-balancer (like Cisco's ACE/CSM, F5 LTM, or Citrix Netscaler to name a few). The devices I mentioned can also offload SSL ...
7
In the immortal words of Cisco (circa 1999), "the PIX is a firewall, not a router"
That said, it can be used as a router. But you're better off using anything else, as it's firewall nature is going to be a pain in the ass. (I used to do it with a PIX 520, and I hated it for all time.) If it's what you have, then it's all you have, but I cannot over ...
7
Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can override that basic function. Once inter-interface/intra-interface is enabled -- thus allowing traffic at all -- ACLs will apply.
(You could set interfaces to ...
7
You certainly could use a L2 switch, and it would probably work just fine. But here are a few reasons why a L3 switch might be a better choice:
You may want to segregate your servers into different VLANs to
simplify access control, apply QoS, limit failure domains, etc. An L3
switch will make this much easier.
While Firewalls can run routing protocols, ...
7
While not necessarily the answer you're looking for... (a) simplicity, and (b) cost. One firewall is half the cost of two. With enterprise grade hardware being rather expensive, when one springs for two, they are most often setup in a high availability failover pair.
Having one firewall for internal LANs, and one for DMZ(s) does provide greater isolation ...
6
If you are using a Cisco PIX 6.2(2) and later or ASA 7.0 and later as your firewall you can do the following:
Create an object-group service, but don't specify tcp-udp after you name it.
Once you hit enter you will be able to use the service-object command to define what udp, tcp, or tcp-udp ports you want, as well as if it is a source or destination ...
6
Certainly! I believe inverse masks were created to be dis-contiguous rather than a normal subnet mask that must be contiguous.
An ACL such as the following should do the trick on an IOS device.
Ip access-list [standard/extended] SUBNET_240
permit ip 10.10.0.0 0.0.255.15
I am not familar with the FWSM but you should be able to create a similar ACL on ...
6
Enter the following commands on your 3850:
no ip route 0.0.0.0 0.0.0.0 10.128.7.1
ip route 0.0.0.0 0.0.0.0 10.128.17.106
This will direct Internet traffic to your firewall. If you haven't set up NAT on your firewall yet, post a copy of your firewall config and we can modify that for you too.
6
The ASA doesn't have the same filtering capabilities, unfortunately.
6
Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's
Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN.. because the 5505 has L2 switch ports rather than "L3 Routed Ports"
If you want to protect somebody plugging into your switch interface and obtaining root-...
6
If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. This does not provide any loop protection, but the ASA (non-5505 as indicated) is incapable of creating a L2 loop and your stated goal is to remove BPDU's from ...
6
You are confusing a couple of things: firewalls, and NAT. While it's true that you can have NAT on many firewalls, they are not even close to the same technologies.
UDP hole punching is used on NAT, which may or may not be configured on a firewall or plain old router. NAT is designed for IPv4 address conservation, not security.
A firewall will typically ...
6
Hey you could have just googled that and the first link is your answer. Here.
Do some research before asking please.
Here's the steps in short:
connect to the fgt with a com cable, if not com port then use USB cable with fortiexplorer. Start the console.
reboot the device and wait for it to ask for the username
Type in the username: maintainer
The ...
6
Most likely the firewall just dropped the packet without sending an RST packet, probably after hitting a session timeout value of some sort. This is typically configurable behaviour.
I personally prefer having that RST packet sent precisely because it helps clients behave normally, but I have heard arguments to the effect that this should not be done on ...
6
The ethernet standard for 1 Gbps means that the ethernet interface can serialize frames at 1 Gbps. What you are seeing is the limitation of the device to process packets. That depends on many factors, including the CPU speed. Basically, the firewall software is slower than the interface hardware speed.
This is something to check whenever you are researching ...
Only top voted, non community-wiki answers of a minimum length are eligible