31
No, ICMP should not be blocked. It's vital signalling protocol. Internet does not function without it.
PMTUD is broken if you drop ICMP.
IPv6 does not even begin to work without ICMP, as L3 to L2 address resolution (ARP in IPV4) is riding on top of ICMP in IPv6.
Also troubleshooting will take longer if ICMP echos are dropped. Alas often FW people train ...
14
All the research of half an hour says that FIN-only is never legitimate.
http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html
Packets should never contain just a FIN flag. FIN packets are
frequently used for port scans, network mapping and other stealth
activities.
https://lists.sans.org/pipermail/list/2006-June/...
answered Aug 25 '18 at 13:01
Marc 'netztier' Luethi
7,1551 gold badge8 silver badges26 bronze badges
13
I don't have SUP7 to test, but it works on SUP6 and SUP32, I would presume SUP7 retains this functionality.
I've tested between JNPR M320 <-> SUP32, and 'vlan mapping JNPR SUP32' works just fine.
There is no need for QinQ, what the QinQ option does is it adds top tag to one particularly tag. So switchport vlan mapping 1042 dot1q-tunnel 42 would map ...
13
Merely putting personal-use internet on a different subnet is normally not sufficient unless that subnet is firewalled from the rest of the company; there are all kinds of internet vulnerabilities that hijack a users' PC and pose a threat to your company unless you are smart about protecting yourself. This is one example of a innocent-looking Wordpress ...
13
Even though dropbox uses AWS, they can be blocked...
Blocking Dropbox
I use an address-based approach for stuff like this, just lookup the address blocks that said company owns and filter it...
Using Robtex information for AS19679 (Dropbox) to block dropbox...
object-group network DROPBOX_AS19679
network-object 108.160.160.0 255.255.240.0
network-...
13
There are several ways to find the IP ranges of major organizations such as Facebook. The most basic of these, is to open up your terminal/command line of choice and issue the command: nslookup facebook.com.
This gives you the associated IP address to that DNS name; in this case, 173.252.110.27 was the answer from my DNS server.
Then run a "whois" lookup ...
13
Best practice wise - should I let the router or the ASA handle NAT
(Overloading)?
In the most general of design best practices NAT is performed between an inside and outside network. NAT overloading is generally performed at the edge when there is limited public IP address space. You can learn more about NAT overloading, also known as Port Address ...
13
Since firewalls essentially filter data, the answer depends on what kind of filtering you do.
If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. If you filter specific ports, you can say you're filtering at layer 4. If your firewall inspects specific protocol states or data, you can say it operates at ...
12
Primary answer
The ASA will perform MAC Address lookup when in transparent mode.
It will do Route lookup only for the following reasons;
Traffic that originate from the ASA (Syslog for example).
Traffic that is one hop away from the ASA with NAT enabled.
VoIP and DNS traffic with inspection enabled and endpoint is one hop away from the ASA.
Source: Cisco'...
12
I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to the configuration.
You can safely delete and add name aliases because the ASA reverts to the IP address when the name disappears...
The original alias is Xbox...
asa5505(config)# sh runn | i Xbox
name 172.16.1.20 Xbox description Xbox
access-list ...
12
Yes, you're missing something. And yes, "something fancy" is going on. The router's NAT state table will map the inside-outside translation for the traceroute probe. (UDP normally) As is required for ICMP to work through any firewall, an ICMP error message will be allowed as part of an established flow. The "fancy" part is the fact the ICMP error carries ...
12
You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can present a distorted view of your flows.
As Cisco explains it, NAT stitching will stitch the (apparently) separate flows to give you the single flow view:
...
11
Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches:
Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure.
set interface x mtu 9216
...
11
You don't mention the kind of firewall, but I suspect most simply drop the packets.
I have a Wireshark dump on server side and I tried to find if firewall
sends a FIN or RST with ip.dst==serverip && (tcp.flags.reset==1 ||
tcp.flags.fin==1) but nothing showed up.
Which would tend to confirm this.
10
I haven't used a Fortigate FW for load balancing, so I will answer some of the questions more generally.
First, as to your problem, the load balancer is doing exactly as it is supposed to do and I think your servers may not be configured correctly to respond to a request on their IP address. If you were to test this behind the load balancing, you could set ...
10
A reload is only required when changing encryption features or downgrading a permanent license. You shouldn't have to break your failover pair either. For a failover pair running >8.3(1), you only need a context license on the primary, and the secondary will inherit. Context licenses applied to both units in a failover pair will combine.
10
Is there any easy way to find out all the IPs that Facebook, Myspace, Snapchat etc uses?
Using Facebook as an example... We police their bandwidth to a small fraction of our total directly on our ASA (because another group in the company owns the web-proxy).
I normally lookup the ASN of the company (Facebook is 32934), then I go to http://as.robtex.com/...
10
The ASA5550 requires the SSM-4GE-INC module to be plugged into the chassis1 when it is booted; if it is not, then you get assertion "_vf_mode_init" failed: file "vf_api.c", line 99 printed to the console.
I discovered this2 after opening a case with TAC (who did not catch this problem), RMA'ing the original chassis, and then unplugging the SSM-4GE-INC ...
9
The two Windstream Routers each have an MPLS port:
192.168.1.2 = Host MPLS
192.168.2.2 = Remote MPLS
The Windstream routers also each have an open internet port to which I have attached a Firewall Router for filtering the internet, making the internet gateways:
192.168.1.1 = Host Gateway
192.168.2.1 = Remote Gateway
Problem ...
8
The FVS338 firewall has SNMP v1 and v2c support according to the Netgear documentation on it (listed under Management Features).
The FS726T switch also supports SNMP v1 according to it's documentation (listed under Administrative Switch Management).
Therefore, any number of free or paid NMS systems could give you the graphical information you're looking ...
8
Yes, you can use a reflexive ACL but it couldn't possibly be as secure as a stateful inspection firewall. Since you are studying for the CCNA, you should build the lab network like real customers do. IOS has a real stateful inspection fw; I would use that.
8
Interface Internal-Data0/0 "", is up, line protocol is up
2749335943 input errors, 0 CRC, 0 frame, 2749335943 overrun, 0 ignored, 0 abort
^^^^^^^^^^^^^^^^^^
0 output errors, 0 collisions, 0 interface resets
You show overruns on the InternalData interfaces, so you are dropping traffic through the ...
8
Answering my own question to help future googlers. I spent about 3 hours on the phone with TAC; we finally got to the root cause of the issue.
The solution is to add a special NAT entry, which matches the IP address in the DNS A-Record when it arrives on the INSIDE interface.
object network DNS_NAT_masd1
description xlate A-Record DMZ src 1.195.18.182 to ...
8
If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s?
This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to be.
So for things like switches that may be entirely processed in hardware, this could be more than a million pps. For a router, this may be lower. For a ...
8
As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does tend to "cripple" their functionality in many ways.
The new trend in security of this type is Network Traffic Analysis (NTA). Just as many companies are far less ...
7
You can do a write mem all:
Saving All Context Configurations at the Same Time
To save all context configurations at the same time, as well as the
system configuration, enter the following command in the system
execution space:
Command Purpose write memory all [/noconfirm] Example: hostname# write
memory all /noconfirm Saves the running ...
7
The simple answer is yes, you can do this and keep the secure network entirely protected from the unsecured network. However, the devil is in the details and there are a number of details missing to provide any real answer.
Specifically, you mention a router and a wireless router, but not the types or the capabilities. If you are talking about consumer ...
7
some support for @ytti 's answer above, hope it helps:
orange#sh ver
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.04.00.SG RELEASE SOFTWARE (fc3)
…
orange#sh mod
Chassis Type : WS-C4507R+E
Mod Ports Card Type Model Serial No.
---+-----+-------------------...
7
Most network vendor software (IOS included) is *nix based, I don't see why this is an issue.
Palo Alto has a number of strengths over an ASA primarily based on an application-based rather than TCP focus:
L7 Application awareness, allowing you to restrict application functions rather than just IPs and port numbers. This provides protection where ...
7
The only way to properly do this, if their IP HAS to be the same as their desktop, is for them to RDP onto their desktop over the VPN.
Or fix the software that's got this ludicrous requirement
Only top voted, non community-wiki answers of a minimum length are eligible
