BWC Cybersecurity Overlord ✭✭✭
Reactions
Comments
-
@ygorsm this discussion came up in the past a couple of times in different contexts. It's only possible to have one concurrent authenticated session from the same source IP, no matter if it's Web, SSO, SSL-VPN etc. The only exception is SSO through TSA, but this does not count here. Sorry that I have to be the bearer of…
-
Looks good to me if Tapart(22) is tcp/22. —Michael@BWC
-
Correct, the upstream firewall has to forward the traffic first. NAT SRC-ORIG: Address Group of authorized public IPs SRC-Translated: Original DEST-ORIG: X1 IP DEST-Translated: internal host which runs SSH Server SVC-ORIG: SSH SVC-Translated: Original Access Rule SRC: Address Group of authorized public IPs DEST: X1 IP…
-
Your SNWL does not see the public IP 62.xx.xx.195, you have to use 172.21.5.1 as Original Destination for your NAT and Access Rule, Translated Destination is your internal IP. But this only works if the router is natting 62.xx.xx.xx.195 to 172.21.5.1 in the first place. —Michael@BWC
-
I don't know at which point in the Packet Flow the Port Scan detection is executed, but it might before the Access Rules. Did you exported a TSR and searched for the UUID? This will give you the information to what the UUID points to. —Michael@BWC
-
What is the netmask of your X1 interface and are all of the public IPs are within the same subnet? Did you tried the suggested NAT rule, it might be enough already. If not it might be necessary to do a static ARP binding for the additional IP on your X1 interface. There is no need to create additional WAN interfaces.…
-
@dc500 IMHO, don't waste any time with the onboard certificate management on the Firewall. Get yourself familar with a tool like XCA (https://www.hohnstaedt.de/xca/) and do your Key/Cert Managed in there. You can import/export as you like. It's mostly Drag&Drop from that point on. I'am using it daily and recommend it to…
-
@emilward how do the 5 public IPs get assigned to X1? As /28 on X1 or via Routing through an upstream CPE? Either way, it should be sufficient to create a NAT rule to hide X2 behind on of the additional IPs: SRC-Orig: X2 subnet SRC-Translated: Address Object holding one of the 5 IPs, Zone WAN DST-Orig: Any DST-Translated:…
-
@jst3751 good that there is a HF available, it would be great to know what the underlying issue is and why I don't face it on my appliance for example. But we'll probably never get this information. —Michael@BWC
-
Hi @Bogale thanks for info, but I ticked all the checkmarks for the reasons already. We have a SMA with 2 Cores and 8 GB of RAM, it only happens if I enable one of these two Exchange offloads, all other Portals are not involved and should be a target for a possible DOS as well. Firmware as mentioned is 10.2.1.14. What do…
-
@David W thanks, I thought we tackled SMA issues in the past, but I guess I confused you with Vijay for some reason, sorry. —Michael@BWC
-
@Sachingorde I reported my current issue with SonicPlatform to Customer Support in (because it's not product related) and the Ticket got closed somewhat immediately with the remark: We have reviewed your case, and this is best addressed by Technical Support rather than Customer Service. You may provide the serial number in…
-
@AKO you might get in touch with support. For my customers I saved the old files in case of a re-deployment. Hopefully the files are available upon request from support, otherwise you're doomed. —Michael@BWC
-
Well, it comes down to "hey, it's me, the ESA for mail.domain.com and here is the cert to prove it". What the sender is doing with that information is not forseeable, it can be ignored and any cert would have worked or it could be enforced by matching names, validity etc. Using DANE (something ESA isn't capable of) is also…
-
@djhurt1 the cert for SMTP is used only on the server side when receiving mails, not involved in the sending part. If you're familar with postfix you might have used the smtpd_tls and smtp_tls directives, which are for receiving and sending, but even in postfix smtp-tls_cert_file for sending is rarely used becuse the…