I was recently drafted into help fix a VPN between a Fortigate in Azure and a good old fashioned on-prem ASA. The former had been deployed by some ARM templates and the latter had some config in place but ,it transpired, not enough. Fixing it brought to light two issues. The first is my offering to the Googlesphere: Issue One Do you know that happy […]
In football there are free-kicks so superbly taken that commentators will say the goalie had no chance. The ball was so perfectly arced into the top right corner that there was nothing the hapless keeper could have done to stop it. What brings me to this? A trouble-shooting scenario where the issue was so deviously constructed – albeit not on purpose – that it felt […]
I’ve been looking at SD-WAN recently and labbed up a simple implementation to test this using GNS3. This is the setup: The southern cloud to the left allows management access to the Fortigate and the cloud next to it is a connection to a VMWare Workstation Linux box. The clouds north of the Fortigate are both GNS3 Nat clouds out to the Internet. It occurs […]
To me MPLS has always been a cloud on a network diagram that was someone else’s problem. But I decided to lab it up and see how it worked. Happily, I found someone who had described how to set up the lab to do just this: https://packetlife.net/blog/2011/may/16/creating-mpls-vpn/ The rest of the post assumes you have read this link but I will repeat or emphasise relevant […]
I encountered one of those smallish problems where I needed to do something slightly out of the ordinary and felt the need to share it here to spare someone a precious few moments re-inventing… not so much the wheel… as the perhaps the furry dice. And so to the problem: I have/had an overly permissive rule on an ASA and after putting more granular rules […]
I never really knew DNS doctoring was much of a thing until I encountered it: essentially getting your firewall to alter or doctor DNS responses. One use case for this might be that you can have your internal hosts receive an internal DNS address whilst keeping them pointing to an external ISP’s DNS. I could go on but somebody already has: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115753-dns-doctoring-asa-config.html So I thought […]
At my new place of work I have encountered Cisco’s NGFW offering: Firepower. The firewall policies are administered on an FMC (Firewall Management Center) and pushed or deployed to enforcement modules called FTDs (Firepower Threat Defense) . Instead of FTD’s you can do this on ASAs with an SFR module but I digress . Posts passim will testify that I like to test NGFWs by […]
Before I left work on Friday some of our proxies were showing a DNS error getting to https://app.powerbi.com our MSP was left pursuing this. I decided to do a bit of digging myself. A DNS query can provide an ‘A’ response which tells the querier the ip address associated with the given name, but often a CNAME record can be returned (Canonical Name) which effectively […]
Ed Harmoush, whose SSL course I waxed lyrical on in an earlier post, has released a freely shareable OpenSSL cheatsheet to publicise a new course specifically on… OpenSSL. So here it is… I haven’t done the OpenSSL course but intend to and I repeat my recommendation for his SSL course… links to his site are on the cheat sheet…
Any readers of this blog will possibly remember that I compared a few different vendors’ firewalls to see how easy it was to configure them to block ssh access when it was running on the non-standard port of tcp 80 which is typically used by http. (This is a little contrived because anyone trying to get out like this would probably use tcp 443 giving […]