firewall-wizards Digest, Vol 16, Issue 6

Send firewall-wizards mailing list submissions to
firewall-wizards@listserv.icsalabs.com

To subscribe or unsubscribe via the World Wide Web, visit
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
or, via email, send a message with subject or body 'help' to
firewall-wizards-request@listserv.icsalabs.com

You can reach the person managing the list at
firewall-wizards-owner@listserv.icsalabs.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of firewall-wizards digest..."

Today's Topics:

1. Re: IPv6 support in firewalls (ArkanoiD)
2. Re: Check Point NG FP3 HF2 on Solaris 5.8 (Behm, Jeffrey L.)
3. Re: CSA Question (bobw@avantsystems.com)
4. Re: New to Cisco PIX/ ASA (Jason)
5. Re: CSA Question (Marcus Gavel (mgavel))

----------------------------------------------------------------------

Message: 1
Date: Wed, 22 Aug 2007 02:01:11 +0400
From: ArkanoiD <ark@eltex.net>
Subject: Re: [fw-wiz] IPv6 support in firewalls
To: dave@corecom.com, Firewall Wizards Security Mailing List
<firewall-wizards@listserv.cybertrust.com>
Message-ID: <20070821220111.GA2364@eltex.net>
Content-Type: text/plain; charset=us-ascii

Well, i guess there are some legacy A and B networks owned but not really
routable reserved by big guys like Pentagon or Citibank ;-)

No, it is not real address shortage that will push us into ipv6,
it's just Vista crowd.

On Wed, Aug 15, 2007 at 01:39:04PM -0400, Dave Piscitello wrote:
> I suppose I should begin by answering "why the interest in IPv6?"
> question. Simply put, we are running out of IPv4 addresses (yeah, I
> know, the Sky is Falling, NAT will save us forever...). Based on current
> consumption rates, some folks speculate that the remaining addresses
> not yet distributed by IANA will be exhausted by 2009.

------------------------------

Message: 2
Date: Tue, 21 Aug 2007 17:07:24 -0500
From: "Behm, Jeffrey L." <BehmJL@bv.com>
Subject: Re: [fw-wiz] Check Point NG FP3 HF2 on Solaris 5.8
To: "Firewall Wizards Security Mailing List"
<firewall-wizards@listserv.cybertrust.com>
Message-ID:
<0C3670BC9169B244AA6E7B2E436180D196372B@TSMC-MAIL-04.na.bvcorp.net>
Content-Type: text/plain; charset="us-ascii"

To the OP: Did you happen to (oops!) put in a rule that stops the
management server from talking to the managed firewall? (or accidentally
take out one that allows it?)

________________________________

From: firewall-wizards-bounces@listserv.cybertrust.com
[mailto:firewall-wizards-bounces@listserv.cybertrust.com] On Behalf Of
Robert D. Hughes
Sent: Thursday, August 02, 2007 2:22 AM
To: Firewall Wizards Security Mailing List; Firewall Wizards
Security Mailing List
Subject: Re: [fw-wiz] Check Point NG FP3 HF2 on Solaris 5.8

Disclaimer: sorry for the top post, I'm stuck in OWA right
now...


FWD won't help with the policy install. In NG, FWM on the
manager talks to CPD on the firewall. FWD was only used pre-NG for
policy installs. Debug those two process to find out what's happening.
You might also try:

fw fetch <manager>

and see if that tells you anything useful.

Regards,
Rob


-----Original Message-----
From: firewall-wizards-bounces@listserv.icsalabs.com on behalf
of Robby Cauwerts
Sent: Wed 8/1/2007 6:00 PM
To: Firewall Wizards Security Mailing List
Subject: Re: [fw-wiz] Check Point NG FP3 HF2 on Solaris 5.8

On 7/20/07, Robert Fenech <robertfenech@gmail.com> wrote:
>
> Hi,
>
> I am encountering a problem when it comes to install a policy
on an NG FP3
> HF2 firewall running on an old Solaris 5.8 machine.
>
> Primarily when the policy is about to be installed I get the
message
> "Failed to install policy. Please make sure that Firewall-1
services are
> running...".
>
>

Try a cprestart or cpstop/cpstart on the fw module ( be aware of
the impact
on your traffic/remote mgmt of the fw!).
And then try to push the policy again a few times.

If this doesn't solve the problem try to debug cpd and fwd
(check CP
knowledgebase or post a reply).

Br.
Robby

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://listserv.icsalabs.com/pipermail/firewall-wizards/attachments/20070821/ffd99e0c/attachment-0001.html

------------------------------

Message: 3
Date: Wed, 22 Aug 2007 07:17:54 -0500 (CDT)
From: "bobw@avantsystems.com" <bobw@avantsystems.com>
Subject: Re: [fw-wiz] CSA Question
To: firewall-wizards@listserv.icsalabs.com
Message-ID: <1187785097.v2.fusewebmail-228660@ffuse9>
Content-Type: text/plain;charset=iso-8859-1

CSA includes default rules that will place the machine in "lockdown" mode
if a compromise is detected; this works quite well, but a false positive
can become a real PITA.

----- Original Message -----
Subject: [fw-wiz] CSA Question
Date: Tue, August 21, 2007 9:06
From: "Carric Dooley" <carric@com2usa.com>
I have been looking thru the Cisco site and I'm wondering if anyone knows
> if you can configure the CSA to disable network interfaces, for instance
> if it's attcked, or shut down.
>
> --
> Carric Dooley
> COM2:Interactive Media USA
> http://www.com2usa.com
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@listserv.icsalabs.com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>

------------------------------

Message: 4
Date: Wed, 22 Aug 2007 08:35:40 -0400
From: Jason <jasonisnow@gmail.com>
Subject: Re: [fw-wiz] New to Cisco PIX/ ASA
To: "Firewall Wizards Security Mailing List"
<firewall-wizards@listserv.icsalabs.com>
Cc: Firewall Wizards Security Mailing List
<firewall-wizards@listserv.cybertrust.com>
Message-ID:
<1de866020708220535m4b8553c6l7ac86adfe9b22823@mail.gmail.com>
Content-Type: text/plain; charset="iso-8859-1"

Only minor thing I'll add for sake of clarity is the need for translation
(NAT or it's many flavors) when traversing any two interfaces on a PIX/ASA.
When typical traffic (non-VPN) from the internal interface, Eth0/0, is
destined for the external interface, Eth0/1, network address translation has
to occur. This would include the use of a nat/global command pairing:

global (outside) 1 66.166.x.x 255.255.x.x
nat (inside) 1 192.168.1.x 255.255.255.x

When traversing any two interfaces you always need two things: permission
(access-list) and translation (NAT or one of its cousins).

On 8/6/07, ArkanoiD <ark@eltex.net> wrote:
>
> Being not a PIX expert, as i see no one answers, no, you do not need
> a reverse rule if the protocol is known and does not require strange
> callbacks.
>
> If it does, it is hard to say how your configuration does look like ;-)
>
> On Wed, Aug 01, 2007 at 06:41:53PM -0400, Keith A. Glass wrote:
> >
> > I've managed Gauntlets, Checkpoints, Netscreens, and SonicWalls in
> the
> > past.
> >
> >
> > I'm a bit confused with the in and outs of the ASA firewalls.
> >
> >
> > I'm setting up at HA pair, my Eth0/0 is my interior interface, trust
> > level 100, Eth 0/1 and 0/2 are my IP and State heatbeats, and Eth 1/0
> > is my external interface, trust level 1.
> >
> >
> > Am I correct in my understanding that if I want two-way traffic,
> > traffic is not blocked to a lower trust level, so I need only write a
> > rule to pass the traffic between the endpoints from the external
> > interface to the internal interface, and the reply traffic is taken
> > care of ?? Or do I have to write a reverse rule, from the internal
> > interface to the external as well ???
> >
> > email protected and scanned by AdvascanTM - keeping email useful -
> >

www.advascan.com
>
> > _______________________________________________
> > firewall-wizards mailing list
> > firewall-wizards@listserv.icsalabs.com
> > https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@listserv.icsalabs.com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>

--
-->j
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://listserv.icsalabs.com/pipermail/firewall-wizards/attachments/20070822/52fdd03c/attachment-0001.html

------------------------------

Message: 5
Date: Wed, 22 Aug 2007 12:21:50 -0400
From: "Marcus Gavel \(mgavel\)" <mgavel@cisco.com>
Subject: Re: [fw-wiz] CSA Question
To: <firewall-wizards@listserv.cybertrust.com>
Cc: Kristian Erik Hermansen <kristian.hermansen@gmail.com>
Message-ID:
<89BDF5F4737898499165AED099FEBDC303AFE05B@xmb-rtp-20b.amer.cisco.com>
Content-Type: text/plain; charset="us-ascii"

There is no single checkbox to do what you describe.

Look at CSA as being able to observe system behavior and set a trigger
based on that.
Once the trigger is set, deny rules will be applied selectively to the
system.
Take care with this, as you can apply deny rule that are persistent.
Timing them out is tricky.

Kristian wrote an internal paper a couple years ago on how to implement
"Port Knocking" using CSA.
It has good methodology on how to implement triggers, apply alternate
rules and then time out those rules.

I'll see if I can get that posted up to the Cisco site.

In the mean time, look at User's guide for the system states of
High/Medium/Low as they apply to Rule Modules and the "Set" action
available in the majority of the rule types.

One implementation might be:
Rule Module 1 - (trigger)
- Connection Rate limit rule
- If greater than 500 connections in a minute, set system
state = high
Rule Module 2 - (enforce)
- If system state = high, apply rules in this module
- All other states and these rules are ignored.
- Rules:
- NACL (Network Access Control) deny all new TCP/UDP
server connections
- Netshield - drop all incoming ICMP traffic
On the CSAMC, configure a alert to email the admin when the last
to rules fire. This will ID the quarantined box.

Marcus Gavel
Cisco Security Agent - QA / Escalation Support

-----Original Message-----
From: Kristian Erik Hermansen [mailto:kristian.hermansen@gmail.com]
Sent: Tuesday, August 21, 2007 7:30 PM
To: firewall-wizards@listserv.cybertrust.com
Cc: Marcus Gavel (mgavel)
Subject: Re: CSA Question

On 8/21/07, Carric Dooley <carric@com2usa.com> wrote:
> I have been looking thru the Cisco site and I'm wondering if anyone
> knows if you can configure the CSA to disable network interfaces, for
> instance if it's attcked, or shut down.

I work on the Cisco Security Agent team, and I do know that there is a
"Network Lock" mode, which will disallow all new connections. I believe
we also added some new features for disabling wireless devices in a
recent release. I am unsure if there is a way to define a rule such as
"if rootkit is detected, disable all interfaces". I am cc'ing Marcus
Gavel who who should be able to get you an answer...
--
Kristian Erik Hermansen

------------------------------

_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

End of firewall-wizards Digest, Vol 16, Issue 6
***********************************************