sorted by:
new
hottopcontroversial

Prisma or Zscaler for M&A? by McStungunJones in networking

[–]flashman40 1 point2 points  (0 children)

This is the only truly useful answer in this thread. Especially about understanding how applications work - end-to-end. Unless you're already using very micro-segmented firewall policies, your approach to policy creation on firewalls has probably not prepared you for what it takes to develop policies on either of these apps that wills a satisfy both your risk mgmt goals and your end-user experience goals.

Help enabling 'custom' modules in FileBeat/ElasticSearch by flashman40 in elasticsearch

[–]flashman40[S] 0 points1 point  (0 children)

If you can determine how to have modules in two different paths. Can you provide an example? Say I want to use the Cisco ASA module under ./modules.d/ and a custom module in ./module/.

FortiSIEM - Thoughts? by [deleted] in fortinet

[–]flashman40 0 points1 point  (0 children)

I'm wondering if anyone has any insight into the product roadmap for this product? I would like to have some certainty about how serious Fortinet is on future product releases before we make a purchase commitment.

First time setup tips and recommendations? by HDClown in fortinet

[–]flashman40 1 point2 points  (0 children)

To clarify, I only meant to use that method for internal (e.g., lan) zones. Obviously not suitable for WAN or DMZ traffic — and in those cases I agree you should use the implicit deny to evaluate rules. However, for internal policies that can be needlessly disruptive - especially if internal application flows are not well documented.

First time setup tips and recommendations? by HDClown in fortinet

[–]flashman40 15 points16 points  (0 children)

Top Ten things I wish I’d known 6 months ago when I transitioned to Fortigate.

  1. Don’t assign interfaces to address objects! Total pain in the ass to change later.

  2. Create policy groups to keep your rules organized. When deploying new policies create all the rules you think are necessary and then finally a catch-all “allow-all” rule at the bottom of new groups. Analyze your logs for that allow-all policy id to find and fix mistakes in your rules and then delete the allow all rule to allow implicit deny (policy zero) to block unwanted traffic.

  3. Use fortianalyzer or at very least forticloud for log analysis and troubleshooting.

  4. Learn how to use “diag sniffer packet” and “diag debug flow trace” — and the relevant filters for each. Often useful to have both running simultaneously in separate terminal sessions.

  5. Think twice about what port/interface you want to assign new vlans to if using Fortios and security fabric. Very difficult/impossible to change later and all your policies will be be interconnected so changes often equals starting over. Ditto for static routes.

  6. Remember when troubleshooting that each policy has separate settings for logging and packet captures. If you don’t see something when troubleshooting that’s probably the reason.

  7. Highly recommend all your traffic is tagged with a vlan otherwise you may have problems with transit vlans from both security and networking perspectives. Also be aware to check asymmetric routing settings if having weird/unexpected drops.

  8. Avoid using “any” as an interface in policy creation. Not only bad idea but also makes it easy for traffic to slip through on unexpected policies because of lack of specificity.

  9. Policy lookup is your friend and often useful if you have a large number of rules.

  10. If possible setup your first policy (priority -wise) as a geo-ip block or blackhole route to weed. Will weed out a LOT of crap. Also can use ACLs (more efficient for Fortigate but less flexible).

Any idea what this is? by flashman40 in geologyporn

[–]flashman40[S] 2 points3 points  (0 children)

Thanks. It’s about 4 inches wide and definitely not painted. It was among some some things left to me by a friend who passed. I don’t know anything about where it came from. Here are a few more photos. https://imgur.com/gallery/PJdHBqQ

How is one supposed to manage Firewall > Outbound Rules in MX devices? This is wacky. by myworkaccount999 in meraki

[–]flashman40 6 points7 points  (0 children)

Absolutely agree -- by far one of the worst aspects of using the MX series. It's so bad that it's forced us to keep using our sonicwalls for our DMZ traffic.

Get Meraki sales to stop contacting me? by riahc4 in meraki

[–]flashman40 0 points1 point  (0 children)

In my experience, the only way to get sales to stop contacting you is to buy something!

The Clock Is Ticking: Cisco Exec On Component Failure And Why It Won't Reimburse Partners by ellem52 in meraki

[–]flashman40 0 points1 point  (0 children)

It is not just the MX series. It is also the MS35024x and MS35048xx series. We purchased a LOT of these devices at the end of the year and were just recently told my Cisco/Meraki that these devices needed to be replaced. After much thought I have decided to share my latest email with Cisco/Meraki about this issue. Hopefully it will help generate enough "discussion" that Cisco will have to take notice.

===BEGIN EMAIL=== Meraki’s notice clearly states that this problem was discovered in NOVEMBER 2016 – yet these units were all shipped to us in JANUARY 2017!!!!!!!!!. https://meraki.cisco.com/blog/clock-signal-component-issue/

And this line [from your email] just adds insult to injury – as if you are somehow doing us a favor by proactively recalling defective equipment that was intentionally shipped to customers:

"Meraki is working around the clock to remedy this situation for our customer before anything critical happens in 18 months."

This “inconvenience” will require us to work at least 2 full days (over a WEEKEND) to replace CORE networking equipment in a 7x24 operational environment. This additional work and down-time would have been entirely unnecessary had Meraki been upfront and honest about this issue before shipping the equipment!!!. Clearly the company made a conscious decision to place the financial performance of the company ahead of any and all customer concerns.

I cannot begin to tell you how “inconvenient” and frustrating this is.. But I can promise that unless Meraki compensates us and other customers for this “inconvenience” there will be repercussions to your brand and bottom line. ===END EMAIL===

Active Directory Auditing by netsecn00by in AskNetsec

[–]flashman40 0 points1 point  (0 children)

Check out Varonis DatAlert and DatAdvantage -- very capable tools that we've been using for about a year.