Table of Contents
Advertisement
Chapter 14: Troubleshooting security
Troubleshooting firewall
This section details commands and ideas used to troubleshoot firewall issues.
Prerequisites to firewall troubleshooting
Achieving network connectedness is a complex achievement. It can be said of firewalls that
after the network is functioning, we are selectively breaking connectivity for users/devices
which we discriminate against. When a device is unreachable to the network, the unreachability
may be intentional. Several debugging options are available to general network administrators
and end users to attempt to see where the 'break' is. But when a firewall is in play, several
complicating factors are introduced:
• Policy Goals Description - There must be an authority somewhere who can describe the
canonical policy goal of which devices are allowed and which are not. This set of policy
goals must be understood by anyone attempting to troubleshoot a network reachability
problem when a firewall is involved.
• Network map - Since firewall policies are expressed in terms of subnets (which are either
permitted or denied) one must know where these subnets are located. In simple cases,
there may be only one directly connected subnet to protect from the internet. But anything
more complicated than a single directly connected subnet will generate the question of
where the subnet exists.
• Access to the firewall login - A troubleshooting engineer must also have access to the
firewall to review the policy configuration and compare it to the policy goals. Also, login
access grants the ability to see firewall events on the console and to enter debugging
commands.
It is typical that Policy Goals Description and access to the firewall login are kept secret and
will be unavailable to all end users and also unavailable to a fair portion of network
administration staff. A network map is sometimes a secret document and sometimes a public
document depending upon site policy. The accuracy of the network map listing subnets and
firewall interfaces must be assured.
Keep in mind that without a policy goal description, a network map, and access to the firewall
login it is unlikely you will be able to troubleshoot firewall issues. Technicians with Avaya would
almost certainly require this information to assist in troubleshooting such issues.
Troubleshooting
August 2013
197
Advertisement
Table of Contents
Troubleshooting
