A hacker in a hoodie with leather gloves tapping a glowing blue lock icon on a transparent touchscreen with ones and zeroes raining down in green

Size: px

Start display at page:

Download "A hacker in a hoodie with leather gloves tapping a glowing blue lock icon on a transparent touchscreen with ones and zeroes raining down in green"

Elinor Lucas
6 years ago
Views:

1 A hacker in a hoodie with leather gloves tapping a glowing blue lock icon on a transparent touchscreen with ones and zeroes raining down in green onto a circuit board

2 jason

3 SYSTEMATIC NETWORK SECURITY TROUBLESHOOTING

4 [citation needed]

5 1. network security challenges 2. A systematic approach to firewalls 3. the four troubleshooting scenarios 4. cheat sheet

6 network security challenges

7 diverse networks routers, VPN, cloud, load balancers, client apps, server apps, mobile, auth/mfa

8 diverse security Firewalls, IDS/IPS, SIEM, sandboxes, SCRUBBERS, proxies, casb, endpoint

9 diverse teams Sec teams, network teams, dev teams, end users, vendors, 3rd parties

10 ALLOW & SECURE THE GOOD TRAFFIC BLOCK THE BAD TRAFFIC THE APP HAS TO WORK.

11 where do you look when the app doesn t work?

12 reality network traffic can be impacted at many points along the path

14 don t guess & don t assume be systematic

15 OSI

16 let s focus on the firewall

17 logs & pcaps

18 logs event records generated by processes packet captures RAW packets going over the network

19 tcp 3-way handshake

20 syn syn/ack ack

22 pcap tcp 3-way handshake completed

23 troubleshooting only 4 scenarios

24 1. firewall doesn t receive the traffic

25 logs empty pcaps empty

26 sending the traffic properly? software firewall? proxy config? routes? logs & pcaps

27 proxy? ips? Sandbox? receiving & forwarding properly? logs & pcaps

28 receiving the traffic? forwarding the traffic properly? logs & pcaps

29 2. firewall receives t he traffic but drops it or doesn t forward it correctly

30 dropping the traffic? acl/rules, ips, rate limiting, malformed packets, session timeout routing out the right int or tun? nat is correct? logs & pcaps

31 3. firewall receives the traffic & forwards it correctly but doesn t see return traffic

32 logs allowed, tx pcaps syn. RST or no syn/ack?

33 traffic logs allowed, o bytes received, timed out

34 pcap syn with no return syn/ack

35 traffic logs allowed, rst received

36 pcap syn, rst

37 receiving the traffic? vpn config? routing? logs & pcaps

38 fw? ips? load balancer? routing? logs & pcaps

39 receiving the traffic? software firewall? app config? logs & pcaps

40 return traffic

41 firewalls are stateful routing tho

42 routed properly? logs & pcaps

43 4. firewall receives the traffic & forwards it & sees return traffic

44 logs allowed, tx, rx pcaps syn, syn/ack. ack?

45 routed properly? logs & pcaps

46 seeing return traffic? receiving syn/ack? sending ack? logs & pcaps

48 pcap note the src & dst mac addrs

49 finding mac addresses

50 mac address & oui lookup

51 cheat sheet

sending the traffic properly? software firewall? proxy config? routes, forwarding properly? proxy, ips, Sandbox? receiving & forwarding properly? return: seeing return traffic? receiving syn/ack?

52 sending the traffic properly? software firewall? proxy config? routes, forwarding properly? proxy, ips, Sandbox? receiving & forwarding properly? return: seeing return traffic? receiving syn/ack? sending ack? logs & pcaps receiving the traffic? forwarding the traffic properly? proxy, ips, Sandbox? receiving & forwarding properly? return: receiving the traffic? forwarding properly? logs & pcaps ` receiving the traffic? dropping the traffic? acl/rules, ips, rate limiting, malformed packets, session timeout routing out the right int or tun? nat is correct? return: receiving the traffic? forwarding properly? logs & pcaps receiving the traffic? vpn config? routing? ips, Sandbox? cloud security groups? receiving & forwarding properly? return: receiving the traffic? forwarding properly? logs & pcaps receiving the traffic? software firewall? app config? ips, Sandbox? receiving & forwarding properly? return: forwarding properly? logs & pcaps SYSTEMATIC NETWORK SECURITY TROUBLESHOOTING the four troubleshooting scenarios: 1. firewall doesn t receive the traffic 2. firewall receives the traffic but drops ` it or doesn t forward it correctly 3. firewall receives the traffic & forwards it correctly but doesn t see return traffic 4. firewall receives the traffic & forwards it & sees return traffic

53 fin

54 questions?

History Page. Barracuda NextGen Firewall F

History Page. Barracuda NextGen Firewall F The Firewall > History page is very useful for troubleshooting. It provides information for all traffic that has passed through the Barracuda NG Firewall. It also provides messages that state why traffic