15
votes
How to know at what OSI Layer(s) does a firewall operate
Since firewalls essentially filter data, the answer depends on what kind of filtering you do.
If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. ...
- 65k
14
votes
Accepted
Is a FIN only segment legal?
All the research of half an hour says that FIN-only is never legitimate.
http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html
Packets should never contain just a ...
- 8,067
12
votes
Accepted
How does NAT Stitching work?
You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can ...
- 96.7k
11
votes
How would a firewall kill a TCP connection without RST or FIN?
You don't mention the kind of firewall, but I suspect most simply drop the packets.
I have a Wireshark dump on server side and I tried to find if firewall
sends a FIN or RST with ip.dst==serverip ...
- 65k
11
votes
Do I get any security benefits by NATing a network that's already behind a firewall?
No.
I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses.
NAT only add complexity without increasing security, if the network and the ...
- 19k
10
votes
How does Deep Packet Inspection work with encrypted packets?
As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does ...
- 27k
10
votes
Difference between firewall and ACL
ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
- 65k
8
votes
Accepted
How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall
If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s?
This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to ...
- 27k
7
votes
Routing with a firewall vs L3 switches
You certainly could use a L2 switch, and it would probably work just fine. But here are a few reasons why a L3 switch might be a better choice:
You may want to segregate your servers into different ...
- 65k
7
votes
The use of DMZ and single firewall design
While not necessarily the answer you're looking for... (a) simplicity, and (b) cost. One firewall is half the cost of two. With enterprise grade hardware being rather expensive, when one springs for ...
- 30.7k
6
votes
Accepted
6
votes
Switchport BPDUs dropped at ASA firewall
Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's
Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN....
- 311
6
votes
Accepted
Switchport BPDUs dropped at ASA firewall
If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. ...
- 1,470
6
votes
Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?
You are confusing a couple of things: firewalls, and NAT. While it's true that you can have NAT on many firewalls, they are not even close to the same technologies.
UDP hole punching is used on NAT, ...
- 96.7k
6
votes
How do I reset a Fortigate firewall password without resetting the firewall
Hey you could have just googled that and the first link is your answer. Here.
Do some research before asking please.
Here's the steps in short:
connect to the fgt with a com cable, if not com port ...
- 394
6
votes
How would a firewall kill a TCP connection without RST or FIN?
Most likely the firewall just dropped the packet without sending an RST packet, probably after hitting a session timeout value of some sort. This is typically configurable behaviour.
I personally ...
- 2,439
6
votes
How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall
The ethernet standard for 1 Gbps means that the ethernet interface can serialize frames at 1 Gbps. What you are seeing is the limitation of the device to process packets. That depends on many factors, ...
- 96.7k
5
votes
Emulate a CISCO PIX Firewall
No. However, the pix (and asa) images can be run via qemu. GNS3 does document how to do this. (as well as various youtube videos, and thousands of blogs.)
[I personally don't bother since the real ...
- 30.7k
5
votes
Accepted
How should I diagnose why my Cisco ASA denies traffic?
The easiest way to figure out why your ASA drops traffic:
If it's a routed ASA firewall, use packet-tracer
Both routed and transparent ASA firewalls can use capture [NAME] asp-drop
Using packet-...
- 29.7k
5
votes
Accepted
Cisco ASA 5512-X has no VPN capabilities
Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (...
- 30.7k
5
votes
Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?
I honestly think that you don't understand the question
I don't understand your question either, and it's probably because I believe you're operating under incorrect assumptions.
Let me be clear - ...
- 8,937
5
votes
Accepted
Network design question
First of all, as they mentioned above it is a poor design. No security engineer would consider exposing their servers directly to public without having any defenses (IPS, Firewall DMZ or host based ...
- 161
5
votes
Accepted
Firewall Policies vs Firewall Rules
Though there are (as far as I know) no strict definitions, you say that policies are the abstract, high level definitions of what traffic should and shouldn't be allowed. Firewall rules are the ...
- 16.4k
5
votes
Accepted
What are the advantages of a firewall over a Layer-3 switch?
Firewalls are usually stateful. Usually, you want a firewall to block everything but established communication, and this can be difficult to impossible with ACLs, depending on the router or switch ...
- 96.7k
5
votes
Accepted
TCP session established even if the server isn't listening on particular port
Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
- 2,273
5
votes
Accepted
VLANS vs. subnets for network security and segmentation
Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by ...
- 12.3k
5
votes
Accepted
Urgent: how to configure different interface using same ip subnet in asa 5506?
The ASA 5506 doesn't have the switchport commands like the 5505. In routed mode, each interface is on a separate subnet, like a router.
- 65k
5
votes
Cisco ASA 5585X Internal-Data0/1 interface errors
From Cisco tech note:
The ASA interface error counter "overrun" tracks the number of times
that a packet was received on the network interface, but there was no
available space in the interface ...
- 65k
5
votes
Accepted
If you're behind a firewall and all the ports are blocked, how is your browser able to access the internet?
A firewall does not "block all ports" - otherwise you could just pull a cable instead of having some firewall. Instead simple firewalls block all incoming connections (what you read as all ports ...
- 2,273
Only top scored, non community-wiki answers of a minimum length are eligible