How to bypass a Firewall Step By Step

[support12]

Hi ! 1. Thanks to ssl vpn and the share power of windows. I have a netscreen that has private ip on its external interface. That interface is conected to your network and get ip thru dhcp. The internal ip has real public ip. I make a Vip to point from internal to external in other words from real ip to your lan private ip. These device make a routed vpn that end on its internal interface so traffic traverse thru internal interface from internet. In that way i can make your network visible to the internet thru your internal lan. Trick!! 2. In case that ipsec is blocked. I will use and internal pc that make and ssl vpn and shared it. The netscreen device will use that ssl vpn to reach the external firewall and make the routed vpn and walaaa. 3. In case that i can not make the ssl vpn. I will use a pc with evdo card, a pc with modem or a evdo device to access the internet and make the routed vpn. Diagram at http://nustream.com/diagram/diagram.jpg

[mbrowndcm]

So you' re allowing access to establish an SSL-VPN source IP address of the LAN subnet, off the internal interface? Where is the hole? Stop access from inside to outside? This is very interesting to me, so I' d like to understand it. This is a good argument for a MAC detection device (like the Cisco ASA).

[support12]

http://nustream.com/diagram/diagram.jpg In the diagram i connect the netscreen device behind the pc so your cisco nac never will see the mac address on the netscreen device. The pc will nat the ip address on the netscreen device. The protocol https is alwas open from inside to outside like http to enable normal browsing. The trick is the power on the pc when share its connections. The nac device will see a trust mac addrees, a trust user and a trust ip addrees using https to the outside world. Then the netscreen device will do a routed ipsec vpn over the existing ssl vpn. So man-in-the-midle will not see the traffic

[#4]

You are missing some steps in your firewall logic, think of a firewall as a gate in a jail. A jail still needs guards, cells, cameras and locks. Without going to so much detail I can think of two main scenarios. 1. protect the LAN from staff 2. protect the LAN from outsider The most obvious problem I SEE is that you are allowing staff or intruder to add devices on your network, well just stop it. Why does normal staff need administrator or power user rights to add network devices? Turn off ICS Implement SOE Do a security check on your staff and hopefully your head sysadmin or firewall engineer does not have a criminal conviction for fraud. If you are allowing strangers access to your office to add devices, I could... call the phone company to install a telephone line + adsl and just connect it to your network. Actually, it might be easier to just walk in and add a wireless device to the network. Nah why don’t I just walk in take the server? I am just pointing out the no firewall is a complete security solution

[support12]

Ok. You are in the same route as i am. To get 70% of security, we need a lot of equipment connected to the network. Many companies only implement 3 , Firewall, Nac and windows or pc security. But 70 seems to low. There is no happy medium. When you need more security the budget $$$ do not supported. Thanks for the comments. The diagram is for firewall, nac and windows security.

[support12]

This diagram exploit the vunerability of any network. If you have and untrust employee.

[support12]

What options are available. I want to stop that back hole.

[support12]

Soon i will put the config for 2 fortigates only

[support12]

Exploit from inside.

[#10]

The protocol https is alwas open from inside to outside like http to enable normal browsing. The trick is the power on the pc when share its connections. The nac device will see a trust mac addrees, a trust user and a trust ip addrees using https to the outside world. Then the netscreen device will do a routed ipsec vpn over the existing ssl vpn. So man-in-the-midle will not see the traffic

If you configure the ssl-vpn policy so that not the lan/subnet is routed, but only the devices you want to be accessed, you already have some control. Second, i do not allow all protocols on the ssl-vpn, so your ipsec routed whatever won' t work, and there i have the missing control in this policy. Third, i use tokens with ' one time passwords + PIN' to access the ssl-vpn webportal, so i know who' s doing what at which time on the ssl-vpn what makes another layer of security. Further more u can restrict some more with custom ips configs i think to add more security in the ssl-vpn. And yes, no network is 100% secure, depends alot on the company' s policy' s and culture, and skills of head admin i guess. My 2 cents...