Re: Raptor Firewall

From: Mike Shaw (mshaw@wwisp.com)
Date: 12/07/01 

Date: Fri, 07 Dec 2001 08:35:54 -0600
To: "Stuart" <stuart.hackinfo@btinternet.com>, <pen-test@securityfocus.com>
From: Mike Shaw <mshaw@wwisp.com>

I used raptor for about 4 years at an old job.

One thing you always have to do with raptor is check the log files. It
usually tells you something that will at least get you started.

The other thing about Raptor is make absolutely sure you have more than
enough RAM, and a very very large swapfile (at least double the regular NT
recommended size was our rule of thumb). There were three times where we
had weird things like this and upping the swapfile/RAM helped.

Do you have SYN flood protection on? Older versions had real performance
problems when this was enabled.

Another thing is to make sure they don't have any strange
configurations--massive port redirections, etc. Check the configs and make
sure it's not the product of a non-educated 'configurer'.

If anything, your pen-test just found a quick way to dos the site! But we
very rarely had problems with Raptor, it's a top-notch product so make sure
they aren't doing something incorrect.

-Mike

At 12:06 AM 12/7/2001 +0000, Stuart wrote:
>We've run a pentest against a customer recently and found that the very act
>of port scanning their Raptor firewall (running on NT) crippled its ability
>to accept incoming connections for their web site. The firewall is a new
>high spec PIII and the least line is a decent size. The nmap scans were
>standard timing (not T5 or anything daft) - once the scans were stopped,
>things burst back in to life within about 10minutes.
>
>This sounds like a lack of available connections type problem (similar to
>SYN flooding) to me. The firewall was running at about 10% CPU usage at the
>time and was not swapping to disk at all, also strangely, internal access
>outbound to the net for web browsing seemed unaffected?
>
>Its the latest version of Raptor and we're told its fully patched up to
>date.
>
>Does this ring any bells with anyone? Seems very odd to me... a portscan
>should not cause a DOS by itself...
>
>
>thanks
>Stuart
>IT Security Consultant, UK
>
>
>----------------------------------------------------------------------------
>This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
>Service. For more information on SecurityFocus' SIA service which
>automatically alerts you to the latest security vulnerabilities please see:
>https://alerts.securityfocus.com/

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • Re: Raptor Firewall 6.5 Config
    ... I used to look after a site that sat behind a Raptor box, ... to do something with those ports, ... won't actually connect to the host unless there is a rule allowing it. ... >This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • RE: Raptor Firewall 6.5 Config
    ... Can I ask a question coming from a completely NON raptor person? ... In other words, if port 21, 23, 80, etc all show up as ... Once raptor has a standard proxy or GSP enabled, it 'opens' that ... >This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • Re: firewalls
    ... because they have the largest install base....I buy it for SECURITY. ... Cisco PIX was the second most common out there. ... like Raptor, it's also one of the most secure and easiest to manage. ...
    (comp.security.firewalls)
  • RE: SQL
    ... Subject: SQL ... >> This list is provided by the SecurityFocus Security ... For more information on SecurityFocus' SIA service which ... >This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • RE: Insurance
    ... property--data beign deemed "intangible" for the purposes of insurance. ... for physical security testing there are often 3rd parties ... For more information on SecurityFocus' SIA service which ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)