About Charles Carmichael

Charles Carmichael · 09-16-2021

Ever since we moved to the new NGFWs, the way our ACPs are setup and ordered, outside scans show ports open because of the way FTD processes rules. Due to it processing a layer 7 rule, it passes the traffic to SNORT for evaluation and therefore it l...

Charles Carmichael · 08-03-2016

Hey everyone. Signature update 932 was automatically applied to my IPS today at 12:16. At 12:17, I started to get a ton of Adobe Acrobat Reader Memory Corruption hits on signature 7615. I'm assuming this is a bug. Is anyone else experiencing the ...

Charles Carmichael · 09-23-2021

So two things resolved this issue. We decided that we had to drop the geolocation rule. It was getting hung up on that rule because it had to pass the traffic to SNORT for analysis which was causing a few packets to get through. We know it was doi...

Charles Carmichael · 09-17-2021

Thanks for the reply, Massimo. As an example, our actual rule where this is happening is on the rule that we have that blocks any non USA ip from coming into our network. Due to that rule using Geolocation, it has to send a few packets through befo...

Charles Carmichael · 09-16-2021

It is currently set to "Block." However, in the past, I believe it was set to "Block with reset", but we have since changed that, but we haven't noticed any change in behavior as far as those few packets getting through and ports "appearing" open. ...

Charles Carmichael · 08-04-2016

Thanks guys. We've decided to disable this signature for right now. ali.imran1, I'm sure you're right regarding Cisco retiring it in the next update.

Member Since	‎11-15-2012 10:03 AM
Date Last Visited	‎10-24-2024 01:37 AM
Posts	6
Total Helpful Votes Received	5

User Statistics

User Activity

Scan Shows Ports Open Due to FTD Rule Actions

Problem with Signature Update 932

Re: Scan Shows Ports Open Due to FTD Rule Actions

Re: Scan Shows Ports Open Due to FTD Rule Actions

Re: Scan Shows Ports Open Due to FTD Rule Actions

Thanks guys. We've decided