What is SNI? SNI (Server Name Indication) is an extension to the TLS protocol, that provides the ability to host multiple HTTPS-enabled sites on a single IP. How does it work? Prior to SNI the client (i.e browser) would send the requested hostname to the webserver within the HTTPS payload (Figure 1). Due to the … Read more
Recently I’ve discovered that there is, well, fairly limited information online around this point. In this short article we will explain how ICMP inspect, whether disabled or enabled, affects the connection table. What is ICMP Inspect? “The ICMP inspection engine allows ICMP traffic to be inspected like TCP and UDP traffic. Without the ICMP inspection … Read more
Problem Lets consider the following scenario. We have a firewall with 3 interfaces, Outside, Inside and DMZ. When traffic is sent to the DMZ segment, the NAT rule below is matched. This results in traffic being sent out of the outside interface, rather then out the DMZ interface. Surely this cant be right ! object-group … Read more
Service Offload Configuration Commands 1. First configure the FPC/PIC (I believe on the SRX1400 if the NP-IOC is in slot 2 it would be FPC2 PIC0 but you can confirm) 2. Then setup a policy from zone x to zone y to allow whatever addressing/protocol and permit services-offload feature for that traffic 3. Then confirm … Read more
Below are some of the most useful commands for the administration within the Gaia CLISH. show commands save config save the current configuration show commands shows all commands show allowed-client all show allowed clients show arp dynamic all displays the dynamic arp entries show arp proxy all shows proxy arp show arp static all displays … Read more
What is ATS ? Introduced within iOS9 and OS X 10.11, App Transport Security (ATS) is a new feature that enforces greater security within Apples application libraries. This means that when an application makes an connection, using the NSURLConnection, CFURL, or NSURLSession libraries, that the connection must meet the following requirements. The server must support … Read more
Introduction Within this article we will take an in-depth look into the architecture of the Cisco ASA 5585X. CHASSIS The Cisco ASA 558X is a chassis based firewall. The chassis consists of 2 slots, each slot can be populated with either an SSP (Security Services Processor) or Interface Module (ASA5585-NM-XX). The SSPs come in various … Read more
Within this article we will provide the necessary commands required to create a read-only account on a Juniper SRX. Within our example a user is created with the following attributes, A user with the username of ‘user1‘. ONLY allowed to use the show command. SNMP configuration is REMOVED from the configuration output. The policy-options and … Read more
HTTP Strict Transport Security (HSTS) is a security policy based on RFC9767 designed to protect domains against both downgrade and passive network attacks. HSTS achieves this by, Transforming all insecure (HTTP) based links to HTTPS links. Allowing the browser to terminate the connection should it observe any certificate warnings or errors with the domains certificate. … Read more
TCP Normalization To provide protection from attacks, the Cisco ASA provides a feature called TCP normalization. TCP normalization is enabled by default and can detect abnormal packets. Once detected these packets can be either allowed, dropped or cleared of its abnormalities. To configure the TCP normalizer changes are made within the tcp-map. The tcp-map is … Read more
A cipher suite is a set of algorithms used within a SSL/TLS session to provide data integrity, authentication and confidentiality for communication between a client and a server. Each cipher suite contains a, Key Exchange algorithm – Used in the creation of a secret key which is used within the bulk encryption process. Also known … Read more
Within this article we will provide the steps required to enable IPv6 on a Juniper SRX device. IPv6 Forwarding First of all we enable IPv6 forwarding. Once this is added you will need to reboot the device. set security forwarding-options family inet6 mode flow-based You can confirm that IPv6 forwarding is enabled once the device … Read more
The ability to configure EtherChannels on ASA models 5510 and above was introduced within 8.4/8.6. An Etherchannel provides a method of aggregating multiple Ethernet links into a single logical channel. Within this article we will provide the steps required to create an Etherchannel link on the Cisco ASA along with providing the main troubleshooting/show commands. … Read more
The Juniper SRX provides an extensive set of options to block and prevent both internal and external based network attacks. Within this article we will look at the various options and settings to block, Sweeps – Horizontal scans, i.e scans across an IP range. Port Scans – Vertical scans, i.e scans across multiple ports on … Read more
There are times where you may require your webpages to be password protected. To achieve this within Apache the usernames and passwords are stored within a flat file called htpasswd. This is then referenced within your Apache configuration. Configure Apache Within your .htaccess file configure the following. AuthType Basic AuthName “restricted area” AuthUserFile /var/www/html/website/.htpasswd require … Read more
Introduction Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted. This is required in scenarios where the private key has been compromised. Certificate Types Prior to a CA issuing a certificate to a company the CA performs a level of validation on the … Read more
Introduction Introduced within Cisco ASA version 8.4(2), Cisco added the ability to allow traffic based on the FQDN (i.e domain name). This feature works by the ASA resolving the IP of the FQDN via DNS which it then stores within its cache. Traffic is then either denied or permitted accordingly. Within this article will look … Read more
Issue This is a nasty little big I found the other day which hopefully you can avoid after reading this article. When using SCP to copy a file to/from the ASA that is over 100k the transfer stalls and then fails. This results in an orphaned ssh_init process. Each ssh_init process then still occupies a … Read more
Purpose The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA firewall (running 8.0). Terms Within this article there are 2 key terms that you will need to know. They are, Hairpinning (U-turn Traffic) – Hairpinning is a term to … Read more
Issue You may experience a slow memory leak within your crypto based processes when running SNMP on your Cisco ASA device. Solution The bug has been resolved within 8.2(5)46 under caveat CSCuh48577.
Issue When trying to run a capture you experience the following error, asa-skyn3t(config)# access-list cap-acl permit ip any any asa-skyn3t(config)# capture inside interface inside access-list cap-acl ERROR: Capture doesn’t support access-list <cap> containing mixed policies Solution Within ASA 9.0 the ‘any’ keyword now represents all IPv4 and IPv6 traffic. And the new keywords ‘any4’ and … Read more
Within this article we will show you the steps required to build an IKEv2 IPSEC Site to Site VPN on a Cisco ASA firewall. IKEv2 provides a number of benefits of its predecessor IKEv1, such as ability for asymmetric authentication methods, greater protection over IKE DoS attacks, interoperability between vendors for DPD/NAT-T, and less overhead and … Read more
Issue Traffic is sent out from the ASA unencrypted. Cause This can be caused by a duplicate (stale) ASP crypto table entry, this prevents the ASA encrypting any traffic destined for the remote host. There are 2 commands which shows this behaviour. They are, Interface outside:!out id=0xd616fff0, priority=70, domain=encrypt, deny=false hits=855899, user_data=0x473ccf4, cs_id=0xd5deba08, reverse, flags=0x0, … Read more
By: Ayman Hammoudeh Introduction Pivoting refers to method used by penetration testers that uses compromised systems to attack other systems on the same network to avoid restrictions such as firewall configurations, which may prohibit direct access to all machines. For example, an attacker compromises a web server on a corporate network; the attacker can then … Read more
Issue You may observe the ASA incorrectly proxy ARPing for an IP address resulting in connectivity issues . Background Within 8.4(2) and 8.6(1) the following NAT changes were introduced.This basically states that Proxy ARP is enabled by default on both static and identity based NAT statements. Reference : http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/intro_intro.html Identity NAT configurable proxy ARP and … Read more
The are 2 main types of SA (Security Association) lifetimes ; soft and hard. Soft lifetime – The soft lifetime defines the number of seconds until the IKE process is informed that the SA is about to expire. This is to provide enough time for the creation of a new SA before the hard lifetime … Read more
The Juniper SRX offers 4 types of High Availability (HA) deployment, Active/Passive Simple Active/Passive Full Mesh Active/Active Deployment Active/Passive Transparent Mode Within this article we will look at Active/Passive Simple upon a SRX 240 series device. Summary Active/Passive is the most common type of HA deployment and consists of 2 firewall members. Whilst one node … Read more
To configure a Site to Site VPN between 2 Peers ; one with a Dynamic IP and the other with a static IP a dynamic crypto map is used. However as the static based peer will be unaware of the remote peers IP the VPN can only be initated from the dynamic side. Note : … Read more
What is Incapsula ? Incapsula is a cloud based service that provides the ability to add further security and also improve the performance of any website in a matter of minutes via a few simple DNS changes. How does it work ? Incapsula works by routing traffic via its global CDN network prior to … Read more
Introduction Within this article we will look into how VPN filters work and also how to configure them on a Cisco ASA firewall. As the name suggests VPN filters provide the ability to permit or deny post-decrypted traffic after it exits a tunnel and pre-encrypted traffic before it enters a tunnel. Note : When the … Read more
IEEE 802.3ad (LACP) is a technology that provides a method of aggregating multiple Ethernet links into a single logical channel. Configuration To configure LACP the following commands are used. This example aggregates the interfaces fe-0/0/3 and fe-0/0/4 into a logical interface named ‘ae1’. This logical interface is then configured as an access port and assigned … Read more
Within this article we will be showing the various steps required in configuring a Cisco ASA IPSEC VPN using digital certificates. These certificates will be signed by a CA (Cisco Router) and downloaded by the Client/ASA using SCEP (Simple Certificate Enrollment Protocol). Time/Date On the client, router and firewall ensure that NTP is configured and … Read more
Error When trying to connect using the Cisco VPN Client with certificate based authentication you receive the following error from you debug logs. CRYPTO_PKI: Certificate validation: Failed, status: 1873. Attempting to retrieve revocation status if necessary ERROR: Certificate validation failed. Peer certificate key usage is invalid, serial number: 210F2EDE0000000009AF, subject name: cn=xxxxx,ou=xxxx,o=xxxxx,c=xx CRYPTO_PKI: Certificate not … Read more
Introduction ASA 8.3 onwards brought a number of changes in how NAT is processed. First of all NAT is built around objects, this allows for IP`s to be changed and objects to be renamed much easier than previously. Also when configuring ACL`s the Real IP/Port address(s) are now used. Pre 8.3 access-list acl-outside extended permit … Read more
Within this tutorial we will show you the nessecary steps in configuring your ASA as a CA server. Time/Date First of all we set the time and date. asa-skyn3t(config)# show clock08:05:40.249 UTC Sun Sep 30 2012 Enable CA Next we enable the ASA as a CA server. asa-skyn3t(config)# crypto ca serverasa-skyn3t(config-ca-server)# subject-name-default cn=skyn3tca, o=skyn3t, c=UKasa-skyn3t(config-ca-server)# … Read more
Within this article we will configure a basic Anyconnect setup. The Anyconnect client provides the ability to securly connect to your LAN via TLS/DTLS (TLS over UDP). Enable WebVPN asa84(config)# webvpnasa84(config-webvpn)# enable outsideINFO: WebVPN and DTLS are enabled on ‘outside’.asa84(config-webvpn)# anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkgERROR: The specified AnyConnect Client image does not exist.asa84(config-webvpn)# anyconnect enableasa84(config-webvpn)# exit Create User … Read more
On the SRX Branch Series each interface can be configured as either layer 2 or layer 3. These are shown below : Routed Ports – Layer 3 (inet) Bridge – Layer 2 (only used for transparent mode) Ethernet-switching – Layer 2 (switchport) Within this article we will look at how to configure a trunk and … Read more
Purpose The purpose of this article is to describe the various steps required to create a site to site VPN between a Cisco ASA and a Juniper Netscreen when both sides have overlapping subnets. Example Within this example each side will have an endpoint of 192.168.10.0/24. Because of this both sides will present their endpoint … Read more
Twice NAT allows you to NAT both the source and destination within a single rule. Scenario A scenario where this type of configuration would be required is shown below. To ensure that any traffic originating from the Internet isn’t sent back out to its default gateway (asymmetrically routed) the source IP is translated to an … Read more
A Certificate Signing Request (CSR) is a base-64 encoded (PEM based) string which is generated using the users public key along with a number of attributes provided by the user such as DN, email, address etc. The CSR is then sent to the CA which it then uses to create a public certificate. The public … Read more
Purpose The purpose of this document is to explain the issues and problems surrounding the use of static NAT when using policy based VPN on a Juniper SRX Firewall. Background The issue, when using static NAT with a policy based VPN centres around how NAT is processed by the SRX, in that the Proxy ID`s … Read more
Purpose The purpose of this document is to explain the configuration methods required to assign to a group-policy to a user based on their OU group. Summary The Cisco ASA firewall includes the ability to assign a user to a group policy based on their OU group. This is achieved via the use of the … Read more
Below shows some of the main Juniper SRX commands available. All commands are provided with the necessary mode in which they should be run from. Configuration Commands replace pattern expr1 with expr # configuration mode find and replace string within configuration show | compare rollback {1..5} # configuration mode compare the current configuration against roll … Read more
Within the Cisco Firewall family (PIX/ASA) there are 2 security features known as Security Levels and NAT Control. Security Levels Security levels are numeric values (between 0 and 100) which are assigned to the firewalls interfaces and used to control traffic flows. Traffic is allowed to pass from a higher security level to a lower … Read more
Purpose The main purpose of this document is to explain the PKI term ‘Chain of Trust’. Summary PKI (Public Key Infrastructure) is a framework built upon protocols, services and standards used to provide authentication, confidentiality, integrity, non-reproduction and access control to digital data. The term ‘Chain of Trust’ is used to describe the trust relationship … Read more
Within this article we will look at the commands required for configuring a Site to Site VPN when one peer is using a dynamic IP address. Note : This article does not include the VPN configuration in its entirety only the additional/amended commands required for this scenario. There are 3 configuration settings that are defined. … Read more
The Juniper SRX offers 3 main types of NAT. These are source, destination and static. In this article we will be providing explanations and configuration examples for each. Source NAT As the name suggests source NAT translates the source IP address. There are 2 main types of source NAT these are: Interface NAT – Traffic … Read more
Below shows the necessary steps/commands to create a route based VPN on a Juniper SRX series gateway. The main difference with a route based VPN is that a tunnel interface is created and assigned to your external interface. Any traffic that you wish to encrypt is routed to this tunnel interface. Access to and from … Read more
Within this tutorial we will be showing you how to configure Remote Access VPN (Dynamic VPN) on the Juniper SRX. IKE Configure Aggressive Mode set security ike policy ike-dyn-vpn-policy mode aggressive set security ike policy ike-dyn-vpn-policy proposal-set standard Define Preshared Key set security ike policy ike-dyn-vpn-policy pre-shared-key ascii-text <PRE-SHARED KEY> Configure the IKE Gateway Here … Read more
Below shows the necessary steps/commands to create a policy based VPN on a Juniper SRX series gateway. The main difference with a policy based VPN is that the tunnel action is defined within each security policy. Note : For troubleshooting steps please see here This VPN is configured with the following : Remote Endpoint : … Read more
Here is our hand-picked selection of the best courses you can find online:
Internet Security Deep Dive course
Complete Cyber Security Course – Hackers Exposed
CompTIA Security+ (SY0-601) Certification Complete course
and our recommended certification practice exams:
AlphaPrep Practice Tests - Free Trial