topic statefull inspection logging/warning without dropping in Firewall and Security Management

statefull inspection logging/warning without dropping

Sebastien_Barbe — Wed, 01 Jul 2020 08:51:54 GMT

we are in the process of migrating some "legacy" applications from one network topology to a new more robust one.

To facilitate this migration we would like to enable statefull inspection but only see the log events without actually dropping the nasty traffic. This would faciliate identifying faulty applications.

Is there a way to do this?

Re: statefull inspection logging/warning without dropping

_Val_ — Fri, 03 Jul 2020 10:09:31 GMT

No, it is not possible to do warning only on out of state connections.

Also, mind, disabling stateful is a global feature, and it will affect all managed gateways, unless you set up it as an exception for only some specific SGs, as on this screenshot (Expections / Add / Select Gateways)

Re: statefull inspection logging/warning without dropping

Sebastien_Barbe — Fri, 03 Jul 2020 10:23:56 GMT

thanks for the feedback. This is indeed what we did (years ago).

But we are facing the difficulty to identify those bad applications without "breaking" things.

Re: statefull inspection logging/warning without dropping

Johan_van_Somme — Fri, 03 Jul 2020 13:04:44 GMT

Hi Sebastian, will it help if you configure a specific port on your sg al monitoring port (promiscous mode) and hook that up to an analyer port on outgoing traffic of Vlan.
Attention: as stated this only monitors the traffic, with inspection. So it doesn't pass traffic, just listens.
In Cisco terms (ER) Span configuration.
Hope this helps,