2022 Developer Survey is open! Take survey.
14 votes
Accepted

Is a FIN only segment legal?

All the research of half an hour says that FIN-only is never legitimate. http://www.whitehats.ca/main/members/Seeker/seeker_tcp_header/seeker_tcp_header.html Packets should never contain just a ...
user avatar
13 votes

How to know at what OSI Layer(s) does a firewall operate

Since firewalls essentially filter data, the answer depends on what kind of filtering you do. If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. ...
user avatar
  • 62.1k
12 votes
Accepted

How does NAT Stitching work?

You must remember that a flow using NAT will look like two different flows: a flow pre-NAT, and a flow post-NAT. This is because NAT is changing one or more of the addresses in the packets. This can ...
user avatar
  • 92.9k
11 votes
Accepted

Juniper SRX HA links passing through switch

Things you should be aware of: SRX HA links communicate using jumbo frames and multicast addresses. So to make this work you need at least the following changes on the EX switches: Configure a jumbo ...
user avatar
11 votes

How would a firewall kill a TCP connection without RST or FIN?

You don't mention the kind of firewall, but I suspect most simply drop the packets. I have a Wireshark dump on server side and I tried to find if firewall sends a FIN or RST with ip.dst==serverip ...
user avatar
  • 62.1k
9 votes

How does Deep Packet Inspection work with encrypted packets?

As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does ...
user avatar
  • 26.7k
8 votes
Accepted

How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall

If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s? This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to ...
user avatar
  • 26.7k
8 votes

Difference between firewall and ACL

ACLs are packet filters. They pass or block packets based on packet data, such as addresses, ports, or other data. They are also stateless. That means the decision to pass or block a packet is based ...
user avatar
  • 62.1k
7 votes
Accepted

Can a Cisco PIX Fiewall be used as a router?

In the immortal words of Cisco (circa 1999), "the PIX is a firewall, not a router" That said, it can be used as a router. But you're better off using anything else, as it's firewall nature is going ...
user avatar
  • 29.5k
7 votes

Cisco ASA 8.2(5) same security routing issue

Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can ...
user avatar
  • 29.5k
7 votes

Routing with a firewall vs L3 switches

You certainly could use a L2 switch, and it would probably work just fine. But here are a few reasons why a L3 switch might be a better choice: You may want to segregate your servers into different ...
user avatar
  • 62.1k
7 votes

The use of DMZ and single firewall design

While not necessarily the answer you're looking for... (a) simplicity, and (b) cost. One firewall is half the cost of two. With enterprise grade hardware being rather expensive, when one springs for ...
user avatar
  • 29.5k
6 votes
Accepted

Cisco ASA and 3850 routing

Enter the following commands on your 3850: no ip route 0.0.0.0 0.0.0.0 10.128.7.1 ip route 0.0.0.0 0.0.0.0 10.128.17.106 This will direct Internet traffic to your firewall. If you haven't set up ...
user avatar
  • 62.1k
6 votes
Accepted

Filter by TCP Flag ASA

The ASA doesn't have the same filtering capabilities, unfortunately.
user avatar
  • 62.1k
6 votes

Switchport BPDUs dropped at ASA firewall

Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN....
user avatar
  • 311
6 votes
Accepted

Switchport BPDUs dropped at ASA firewall

If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. ...
user avatar
  • 1,470
6 votes

Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?

You are confusing a couple of things: firewalls, and NAT. While it's true that you can have NAT on many firewalls, they are not even close to the same technologies. UDP hole punching is used on NAT, ...
user avatar
  • 92.9k
6 votes

How do I reset a Fortigate firewall password without resetting the firewall

Hey you could have just googled that and the first link is your answer. Here. Do some research before asking please. Here's the steps in short: connect to the fgt with a com cable, if not com port ...
user avatar
6 votes

How would a firewall kill a TCP connection without RST or FIN?

Most likely the firewall just dropped the packet without sending an RST packet, probably after hitting a session timeout value of some sort. This is typically configurable behaviour. I personally ...
user avatar
6 votes

How many pps (64Byte each) i can receive in 1Gbps throughput modem / firewall

The ethernet standard for 1 Gbps means that the ethernet interface can serialize frames at 1 Gbps. What you are seeing is the limitation of the device to process packets. That depends on many factors, ...
user avatar
  • 92.9k
5 votes
Accepted

Trying to fit centralised firewall into network topology

I'd pick one of two choices: Individual per-tenant Virtual Firewalls Pros: Horizontally scalable Spin-up and spin-down Relatively immune to future topology/design changes Complete customer ...
user avatar
5 votes

Emulate a CISCO PIX Firewall

No. However, the pix (and asa) images can be run via qemu. GNS3 does document how to do this. (as well as various youtube videos, and thousands of blogs.) [I personally don't bother since the real ...
user avatar
  • 29.5k
5 votes
Accepted

How should I diagnose why my Cisco ASA denies traffic?

The easiest way to figure out why your ASA drops traffic: If it's a routed ASA firewall, use packet-tracer Both routed and transparent ASA firewalls can use capture [NAME] asp-drop Using packet-...
user avatar
5 votes
Accepted

Cisco ASA 5512-X has no VPN capabilities

Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (...
user avatar
  • 29.5k
5 votes

Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?

I honestly think that you don't understand the question I don't understand your question either, and it's probably because I believe you're operating under incorrect assumptions. Let me be clear - ...
user avatar
  • 8,847
5 votes
Accepted

Network design question

First of all, as they mentioned above it is a poor design. No security engineer would consider exposing their servers directly to public without having any defenses (IPS, Firewall DMZ or host based ...
user avatar
  • 161
5 votes
Accepted

Firewall Policies vs Firewall Rules

Though there are (as far as I know) no strict definitions, you say that policies are the abstract, high level definitions of what traffic should and shouldn't be allowed. Firewall rules are the ...
user avatar
  • 15.6k
5 votes
Accepted

What are the advantages of a firewall over a Layer-3 switch?

Firewalls are usually stateful. Usually, you want a firewall to block everything but established communication, and this can be difficult to impossible with ACLs, depending on the router or switch ...
user avatar
  • 92.9k
5 votes
Accepted

TCP session established even if the server isn't listening on particular port

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible