14
votes
Accepted
Is a FIN only segment legal?
All the research of half an hour says that FIN-only is never legitimate.
http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html
Packets should never contain just a ...
- 7,696
13
votes
How to know at what OSI Layer(s) does a firewall operate
Since firewalls essentially filter data, the answer depends on what kind of filtering you do.
If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. ...
- 62.1k
12
votes
Accepted
How does NAT Stitching work?
You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can ...
- 92.9k
11
votes
Accepted
Juniper SRX HA links passing through switch
Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches:
Configure a jumbo ...
- 7,997
11
votes
How would a firewall kill a TCP connection without RST or FIN?
You don't mention the kind of firewall, but I suspect most simply drop the packets.
I have a Wireshark dump on server side and I tried to find if firewall
sends a FIN or RST with ip.dst==serverip ...
- 62.1k
9
votes
How does Deep Packet Inspection work with encrypted packets?
As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does ...
- 26.7k
8
votes
Accepted
How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall
If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s?
This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to ...
- 26.7k
8
votes
Difference between firewall and ACL
ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
- 62.1k
7
votes
Accepted
Can a Cisco PIX Fiewall be used as a router?
In the immortal words of Cisco (circa 1999), "the PIX is a firewall, not a router"
That said, it can be used as a router. But you're better off using anything else, as it's firewall nature is going ...
- 29.5k
7
votes
Cisco ASA 8.2(5) same security routing issue
Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can ...
- 29.5k
7
votes
Routing with a firewall vs L3 switches
You certainly could use a L2 switch, and it would probably work just fine. But here are a few reasons why a L3 switch might be a better choice:
You may want to segregate your servers into different ...
- 62.1k
7
votes
The use of DMZ and single firewall design
While not necessarily the answer you're looking for... (a) simplicity, and (b) cost. One firewall is half the cost of two. With enterprise grade hardware being rather expensive, when one springs for ...
- 29.5k
6
votes
Accepted
Cisco ASA and 3850 routing
Enter the following commands on your 3850:
no ip route 0.0.0.0 0.0.0.0 10.128.7.1
ip route 0.0.0.0 0.0.0.0 10.128.17.106
This will direct Internet traffic to your firewall. If you haven't set up ...
- 62.1k
6
votes
Accepted
6
votes
Switchport BPDUs dropped at ASA firewall
Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's
Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN....
- 311
6
votes
Accepted
Switchport BPDUs dropped at ASA firewall
If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. ...
- 1,470
6
votes
Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?
You are confusing a couple of things: firewalls, and NAT. While it's true that you can have NAT on many firewalls, they are not even close to the same technologies.
UDP hole punching is used on NAT, ...
- 92.9k
6
votes
How do I reset a Fortigate firewall password without resetting the firewall
Hey you could have just googled that and the first link is your answer. Here.
Do some research before asking please.
Here's the steps in short:
connect to the fgt with a com cable, if not com port ...
- 394
6
votes
How would a firewall kill a TCP connection without RST or FIN?
Most likely the firewall just dropped the packet without sending an RST packet, probably after hitting a session timeout value of some sort. This is typically configurable behaviour.
I personally ...
- 2,439
6
votes
How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall
The ethernet standard for 1 Gbps means that the ethernet interface can serialize frames at 1 Gbps. What you are seeing is the limitation of the device to process packets. That depends on many factors, ...
- 92.9k
5
votes
Accepted
Trying to fit centralised firewall into network topology
I'd pick one of two choices:
Individual per-tenant Virtual Firewalls
Pros:
Horizontally scalable
Spin-up and spin-down
Relatively immune to future topology/design changes
Complete customer ...
- 8,996
5
votes
Emulate a CISCO PIX Firewall
No. However, the pix (and asa) images can be run via qemu. GNS3 does document how to do this. (as well as various youtube videos, and thousands of blogs.)
[I personally don't bother since the real ...
- 29.5k
5
votes
Accepted
How should I diagnose why my Cisco ASA denies traffic?
The easiest way to figure out why your ASA drops traffic:
If it's a routed ASA firewall, use packet-tracer
Both routed and transparent ASA firewalls can use capture [NAME] asp-drop
Using packet-...
- 29.5k
5
votes
Accepted
Cisco ASA 5512-X has no VPN capabilities
Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (...
- 29.5k
5
votes
Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?
I honestly think that you don't understand the question
I don't understand your question either, and it's probably because I believe you're operating under incorrect assumptions.
Let me be clear - ...
- 8,847
5
votes
Accepted
Network design question
First of all, as they mentioned above it is a poor design. No security engineer would consider exposing their servers directly to public without having any defenses (IPS, Firewall DMZ or host based ...
- 161
5
votes
Accepted
Firewall Policies vs Firewall Rules
Though there are (as far as I know) no strict definitions, you say that policies are the abstract, high level definitions of what traffic should and shouldn't be allowed. Firewall rules are the ...
- 15.6k
5
votes
Accepted
What are the advantages of a firewall over a Layer-3 switch?
Firewalls are usually stateful. Usually, you want a firewall to block everything but established communication, and this can be difficult to impossible with ACLs, depending on the router or switch ...
- 92.9k
5
votes
Accepted
TCP session established even if the server isn't listening on particular port
Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
- 2,033
Only top scored, non community-wiki answers of a minimum length are eligible