Firewall Typical Networking and Troubleshooting Common Faults

1. Firewall Typical Networking and Troubleshooting Common Faults

2. Objectives • Master the typical networking of SecPath firewall. • Master the skills of troubleshooting common faults of SecPath firewall. Upon completion of this course, you will be able to:

3. Contents Common Firewall Networking Troubleshooting Common Faults of Firewall 3Com Confidential.

4. Cases of Common Firewall Networking • Applications at the egress of government and enterprise vertical networks • Applications in the networking of financial and security industries • Applications with carrier-class reliability

5. Internet Applications at the Egress of Government and Enterprise Vertical Networks Trust domain SecPath firewall Enterprise users Untrust domain Server cluster DMZ domain

6. Internet Applications in the Networking of Financial and Security Industries Intranet DMZ domain 1 Browse web page Server Authentication server DMZ domain 2 Data center E-commerce Enterprise user SecPath A SecPath B Trust domain Enterprise user untrust domain Online banking

7. Applications with carrier-class reliability Enterprise user Intranet Internet Public network server Branch

8. Contents Common Firewall Networking Troubleshooting Common Faults of Firewall 3Com Confidential.

9. Troubleshooting Process • Check the physical link status. • Check the firewall default action (interception or release). • Check whether the interface is added into the correct domain. • Check whether the ARP table items are correct. • Check the matching status of the ACL rules. • Check whether the NAT table items are correct. • Check whether ASPF is activated in the correct interface and direction. • Check whether the domain statistics function is activated.

10. Symptom of Common Faults (1) • Symptom: After the firewall interface is configured with an IP address, the execution of the ping command of the IP address is not successful. • Diagnosis: Ping failure may be caused by the following factors. Rule out the possibilities one by one. 1) Ensure the up status of the firewall physical link. 2) Ensure that the physical interface is added into one of the domains. 3) Check the default rules and ACL rules of the firewall. 4) Check whether the ARP table items contain the MAC address of the peer equipment. 5) Query the receiving/transmitting of the ICMP packets with the debug command.

11. Symptom of Common Faults (2) • Symptom: After the port scanning and address scanning intrusion protection and the dynamic blacklist, the firewall cannot view the intrusion log. In addition, the scanning source addresses are not added dynamically into the blacklist. • Diagnosis: 1) Check whether the scanning speed of the scanning tool exceeds the max-rate value per second set by the configuration file. 2) Check whether the blacklist function is activated. 3) Check whether IP statistics function for the connection with the outgoing direction of the domain of the initiator is activated or not.

12. Symptom of Common Faults (3) • Symptom: After the filtering based on key words of the web page content is set, it is not valid. • Diagnosis: 1) Check whether the ASPF is configured to detect HTTP. 2) Check whether the ASPF is applied to the interface or between the domains. 3) Query the filtering record with the display firewall web-filter command. (Precaution: When the web page filtering and mail filtering are configured, the ASPF detection function must be enabled.)

13. Symptom of Common Faults (4) • Symptom: The system cannot detect the 2FE card. • Diagnosis: 1) Query whether the 2FE card has been registered with the display version command. 2) Check the type of the 2FE card. There are two types of 2FE cards. secpath supports only the 2fe of the 82559 chip. It does not support the 2fe of the 21143 chip. Differentiation method of two types of boards: (Note: Differentiation is achieved through eye observation of the physical chips of the boards. For the 2FE of the 21143 chip, there is a 4 square centimeters chip the near the pci socket, with the 21143 identification. For the 2FE of the 82559 chip, there is only a 1 square centimeter chip in the middle of the board, with the 82559 identification.)

14. Symptom of Common Faults (5) • Symptom: The transparent mode of the firewall is set to “transparent”. The routers on both sides of the firewall cannot establish the OSPF neighbor relationship. • Diagnosis: 1)Check whether the flood or broadcast function is activated for the unknow-mac. 2)Check with the ping command whether both ends of the physical link is connected. 3)Check whether the area No., network No., hello interval, and dead interval of the hello packets of both ends are consistent. 4) For others, please refer to the debugging of the OSPF protocol.

15. Symptom of Common Faults (6) • Symptom: After the setting of the GRE tunnel is completed, the ping command of the peer tunnel interface is not successful. • Diagnosis: Rule out the possible causes one by one: 1)Ensure that the tunnel interface has been added into the residing domain of the public network. 2)Check whether the tunnel interface has been in the up status with the display interface tunnel command. 2)Check whether the tunnel has been configured with correct source and destination addresses. 3)Check whether the router table contains the route to the tunnel destination address, or check whether the tunnel destination address is reachable with the ping command. (Precaution: All interfaces, either physical interface or virtual interface, must be added into a certain domain.)

16. Symptom of Common Faults (7) • Symptom: When the browser is applied to log in to the firewall, “The page cannot be found” is prompted. • Diagnosis: 1) Check whether the physical link from the PC to the firewall is faulty. 2) Check whether flash contains the http.zip file with the dir command. 3) If the file does not exist, separate the file from the system software with the detach command.

17. Summary The course is summarized as follows: • Common networking modes of the firewall • Troubleshooting common faults of the SecPath firewall

18. Thank you