15 votes

How to know at what OSI Layer(s) does a firewall operate

Since firewalls essentially filter data, the answer depends on what kind of filtering you do. If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. ...
  • 65k
14 votes
Accepted

Is a FIN only segment legal?

All the research of half an hour says that FIN-only is never legitimate. http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html Packets should never contain just a ...
12 votes
Accepted

How does NAT Stitching work?

You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can ...
  • 96.7k
11 votes

How would a firewall kill a TCP connection without RST or FIN?

You don't mention the kind of firewall, but I suspect most simply drop the packets. I have a Wireshark dump on server side and I tried to find if firewall sends a FIN or RST with ip.dst==serverip ...
  • 65k
11 votes

Do I get any security benefits by NATing a network that's already behind a firewall?

No. I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses. NAT only add complexity without increasing security, if the network and the ...
  • 19k
10 votes

How does Deep Packet Inspection work with encrypted packets?

As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does ...
  • 27k
10 votes

Difference between firewall and ACL

ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
  • 65k
8 votes
Accepted

How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall

If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s? This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to ...
  • 27k
7 votes

Routing with a firewall vs L3 switches

You certainly could use a L2 switch, and it would probably work just fine. But here are a few reasons why a L3 switch might be a better choice: You may want to segregate your servers into different ...
  • 65k
7 votes

The use of DMZ and single firewall design

While not necessarily the answer you're looking for... (a) simplicity, and (b) cost. One firewall is half the cost of two. With enterprise grade hardware being rather expensive, when one springs for ...
  • 30.7k
6 votes
Accepted

Filter by TCP Flag ASA

The ASA doesn't have the same filtering capabilities, unfortunately.
  • 65k
6 votes

Switchport BPDUs dropped at ASA firewall

Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN....
  • 311
6 votes
Accepted

Switchport BPDUs dropped at ASA firewall

If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. ...
  • 1,470
6 votes

Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?

You are confusing a couple of things: firewalls, and NAT. While it's true that you can have NAT on many firewalls, they are not even close to the same technologies. UDP hole punching is used on NAT, ...
  • 96.7k
6 votes

How do I reset a Fortigate firewall password without resetting the firewall

Hey you could have just googled that and the first link is your answer. Here. Do some research before asking please. Here's the steps in short: connect to the fgt with a com cable, if not com port ...
6 votes

How would a firewall kill a TCP connection without RST or FIN?

Most likely the firewall just dropped the packet without sending an RST packet, probably after hitting a session timeout value of some sort. This is typically configurable behaviour. I personally ...
6 votes

How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall

The ethernet standard for 1 Gbps means that the ethernet interface can serialize frames at 1 Gbps. What you are seeing is the limitation of the device to process packets. That depends on many factors, ...
  • 96.7k
5 votes

Emulate a CISCO PIX Firewall

No. However, the pix (and asa) images can be run via qemu. GNS3 does document how to do this. (as well as various youtube videos, and thousands of blogs.) [I personally don't bother since the real ...
  • 30.7k
5 votes
Accepted

How should I diagnose why my Cisco ASA denies traffic?

The easiest way to figure out why your ASA drops traffic: If it's a routed ASA firewall, use packet-tracer Both routed and transparent ASA firewalls can use capture [NAME] asp-drop Using packet-...
5 votes
Accepted

Cisco ASA 5512-X has no VPN capabilities

Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (...
  • 30.7k
5 votes

Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?

I honestly think that you don't understand the question I don't understand your question either, and it's probably because I believe you're operating under incorrect assumptions. Let me be clear - ...
  • 8,937
5 votes
Accepted

Network design question

First of all, as they mentioned above it is a poor design. No security engineer would consider exposing their servers directly to public without having any defenses (IPS, Firewall DMZ or host based ...
  • 161
5 votes
Accepted

Firewall Policies vs Firewall Rules

Though there are (as far as I know) no strict definitions, you say that policies are the abstract, high level definitions of what traffic should and shouldn't be allowed. Firewall rules are the ...
  • 16.4k
5 votes
Accepted

What are the advantages of a firewall over a Layer-3 switch?

Firewalls are usually stateful. Usually, you want a firewall to block everything but established communication, and this can be difficult to impossible with ACLs, depending on the router or switch ...
  • 96.7k
5 votes
Accepted

TCP session established even if the server isn't listening on particular port

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
5 votes
Accepted

VLANS vs. subnets for network security and segmentation

Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by ...
  • 12.3k
5 votes
Accepted

Urgent: how to configure different interface using same ip subnet in asa 5506?

The ASA 5506 doesn't have the switchport commands like the 5505. In routed mode, each interface is on a separate subnet, like a router.
  • 65k
5 votes

Cisco ASA 5585X Internal-Data0/1 interface errors

From Cisco tech note: The ASA interface error counter "overrun" tracks the number of times that a packet was received on the network interface, but there was no available space in the interface ...
  • 65k
5 votes
Accepted

If you're behind a firewall and all the ports are blocked, how is your browser able to access the internet?

A firewall does not "block all ports" - otherwise you could just pull a cable instead of having some firewall. Instead simple firewalls block all incoming connections (what you read as all ports ...

Only top scored, non community-wiki answers of a minimum length are eligible