RE: [fw-wiz] Forwarding traffic to an active IDS/Firewall

From: Paul Melson (pmelson_at_gmail.com)
Date: 07/21/05

  • Next message: Dale W. Carder: "Re: [fw-wiz] Forwarding traffic to an active IDS/Firewall" 
    To: "'Vinicius Pavanelli Vianna'" <ds@hacked.com.br>, <firewall-wizards@honor.icsalabs.com>
Date: Thu, 21 Jul 2005 12:05:49 -0400

    I'm not sure I have a clear understanding of what you're asking for, but in
    effect, the 'fwd' command of ipfw does simple policy routing. Depending on
    the model and OS version of your switch, policy routing should be possible.
    See:
    http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration
    _guide_chapter09186a00801cdf81.html#1260543
     
    PaulM

    -----Original Message-----
    Subject: [fw-wiz] Forwarding traffic to an active IDS/Firewall

    Hi all,

    Anyone knows how I can forward all traffic the came to a Cisco Catalyst
    swith to an gateway to do some IDS/Firewall/Traffic Shape?
    In ipfw (freebsd) this would be done by an "fwd" rule to forward all packets
    to an forced gateway, this can be done in an cisco device or i need to
    emulate all the valid IPs on the switch and use a VLAN with the servers so
    the IDS receive the packets and forward to the internal VLAN, this would be
    a little harmful ;)

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Dale W. Carder: "Re: [fw-wiz] Forwarding traffic to an active IDS/Firewall"

    Relevant Pages

    • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
      ... For simple using, however, you don't need to bother all that details - just remember magic number and where to place it, and it is now simple for use with ipfw tags. ... Currently the only analyzing node in FreeBSD src tree is ng_bpf, but it merely splits incoming packets in two streams, matched and not. ... There are reasons to this, as netgraph needs to be modular, and each node does a small thing, but does it well. ... For long time ng_bpf was used for another purposes in the kernel, and now, as new ipfw features appeared, ng_tag came up for easy integration. ...
      (freebsd-current)
    • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
      ... For simple using, however, you don't need to bother all that details - just remember magic number and where to place it, and it is now simple for use with ipfw tags. ... Currently the only analyzing node in FreeBSD src tree is ng_bpf, but it merely splits incoming packets in two streams, matched and not. ... There are reasons to this, as netgraph needs to be modular, and each node does a small thing, but does it well. ... For long time ng_bpf was used for another purposes in the kernel, and now, as new ipfw features appeared, ng_tag came up for easy integration. ...
      (freebsd-isp)
    • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
      ... For simple using, however, you don't need to bother all that details - just remember magic number and where to place it, and it is now simple for use with ipfw tags. ... Currently the only analyzing node in FreeBSD src tree is ng_bpf, but it merely splits incoming packets in two streams, matched and not. ... There are reasons to this, as netgraph needs to be modular, and each node does a small thing, but does it well. ... For long time ng_bpf was used for another purposes in the kernel, and now, as new ipfw features appeared, ng_tag came up for easy integration. ...
      (freebsd-net)
    • FreeBSD Security Advisory: FreeBSD-SA-01:08.ipfw [REVISED]
      ... included in FreeBSD 4.0 and above. ... based on an old version of ipfw and does not contain as many features. ... Due to overloading of the TCP reserved flags field, ... incorrectly treat all TCP packets with the ECE flag set as being part ...
      (FreeBSD-Security)
    • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
      ... The problem with pf is that pf compiles all the rules at the time, so exact tags representation can change each time (for this reason ipfw tags were made incompatible with pf), and you must that values to supply them to. ... Also, as it seems non-trivial on current ipfw dynamic rules implementation, I don't know if shaping will work at all. ... But you can try to test such ruleset (it supposes that dynamic rules are checked twice, on incoming packets and on outgoing also, as with all other rules as ipfw manpage says): ...
      (freebsd-current)