Description
When a Vital Security Web Appliance is deployed as the default gateway for multiple network segments, only one segment might be able to access the Internet due to anti-spoofing policies on the firewall.
Symptoms
Users from one segment that routes through the Finjan appliance are able to access all Internet services that are permitted by the firewall. However, users from other segments that route through the Finjan appliance are unable to access the Internet or are only able to access the Internet via the protocols monitored by the Finjan appliance. For example, HTTP and FTP might work, but HTTPS might not.
Cause
If multiple network segments that previously communicated directly with different interfaces on a firewall are rerouted through a transparent Vital Security Appliance, it is possible that an anti-spoofing policy on the firewall will block transmissions originating from all but one of the network segments. Specifically, the firewall will likely allow only communications from the segment that includes the firewall interface which serves as the Vital Security Appliance’s default gateway. This is due to the way that firewall anti-spoofing policies operate.
Solution
To allow traffic from all network segments that route through the Finjan appliance, it is important that the firewall’s anti-spoofing policy be configured properly. The firewall interface that serves as the Finjan appliance’s default gateway must be configured to accept traffic from all IP subnets that are routing through the Finjan device. An alternative would be to simply disable anti-spoofing on the firewall’s internal interfaces.
By reviewing the firewall’s logs, it is often possible to determine that anti-spoofing policies are responsible for preventing connections from specific network segments. Search the logs for blocked transactions that originate from user IPs in segments that are unable to connect to the Internet. For example, if a segment that is unable to connect to the Internet does not have its own internal DNS server, look for blocked connections to port 53. DNS transactions should account for a large number of the blocked transactions because clients must first look up the IP address of a host before they connect.
Additionally, a network capture from the Finjan appliance can help with troubleshooting. Start a capture from the Finjan appliance while trying to connect to the Internet from a client on one of the segments that is having difficulty connecting. Capture traffic on the Finjan interface that communicates directly with the firewall. If the capture shows the Finjan appliance forwarding the client’s packets to the firewall but does not show any response from the firewall, then it is clear that an upstream device (most likely the firewall itself) is blocking the traffic.
For more information on anti-spoofing, please consult with the firewall documentation or vendor.
Software Version
8.4.x
- This article applies to:
- NG 1000
- NG 5000
- NG 6000
- This article was previously published as:
- Finjan KB 1571