My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. This tutorial will assist you in setting up FireEye Integration With BlueCoat Proxy, by using a URL list populated by FireEye to use in the BlueCoat as another web filter. This filter can then be used in BlueCoat policy just like the BCWF, McAfee Smartfilter, etc... … [Read more...]
My Experience With SANS NetWars Tournament
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. I attended the SANS NetWars Tournament at the SANS Rocky Mountain Conference 2013 in Denver, while attending the SEC504: Hacker Techniques, Exploits & Incident Handling course taught by: James Lyne - Global Head of Security Research at Sophos Kevin Fiscus - Owner/Senior Consultant at Cyber Defense Advisors Both James and Kevin were fantastic instructors with … [Read more...]
Blue Coat ProxySG – Splash Page Updates
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. In my previous blathering’s about BlueCoat splash pages, I always had used the variable $(cs-categories) to identify which BlueCoat WebFilter (BCWF) the requested URL was a child of. But this displays ALL the categories that a specific URL/site is a member of, not just the one that is the criteria for the block. In your day to day administration and troubleshooting of … [Read more...]
Blue Coat ProxySG – Issues Upgrading SGOS From 5.5.x.x to 6.2.x.x
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. Following an upgrade on a Blue Coat ProxySG 600-10, from 5.5.3.31 to 6.2.9.1, I encountered the errors below, and was unable to pass traffic thru the proxy using the BlueCoat WebFilter categories for "Allow"/"Deny". As this specific ProxySG is a non-production device, there are very minimal users working with it, and the first I noticed of the issue, was an email from … [Read more...]
Checkpoint VSX Commands
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. This is a short list of Checkpoint VSX Commands that I am compiling as I continue to work with CheckPoint VSX systems. The list is not comprehensive and may not work for everyone, so if you see errors, please contact me so I may correct them. Thanks! /ryan Check Point CLI "CP" Commands CLI Command Command Description vsx get View current shell … [Read more...]
Check Point Quick Reference – Tcpdump
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. NOTE: fw monitor operates above layer 2 and does not include mac address information - cant see ARP messages. tcpdump can see layer 2 ARP messages This is one of the most common tcpdump commands: (looks for packets from a src to dst, need to specify interface) tcpdump nn-i eth2 host 11.11.11.11 and host 22.22.22.22 08:02:15.043273 11.11.11.11.62044 > … [Read more...]
Check Point Quick Reference – FW Monitor
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. Overview: FW Monitor is a built-in firewall tool which needs no separate install on the device you wish to capture packets and interrogate connections. It is a functionality provided with the installation of the FW-1 package and syntax is also identical across all FW-1 installations. FW Monitor allows for sampling the connection from 4 different points in the firewall, … [Read more...]
Firewall Commands For Identifying Specific Routes
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. The Question: Using firewall commands, identify the route to specific destination/target without using the routing table (more specific) I was asked the question today, and blanked out... I have ran the Cisco and CheckPoint IPSO versions, but not Splat and still couldn't pull it from memory. Once I looked it up I felt silly, but knew it will be a good addition to my … [Read more...]
CheckPoint SmartDashboard – Missing Menu
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. Hello All. I was bouncing around in the Checkpoint SmartDashboard, updating rules in some firewalls and noticed that the menu bar at the top of the window was missing... After some searching, I found that a registry setting needed to be modified to restore the SmartDashboard menu bar. Here is the registry path that needed to be … [Read more...]
FTP Client Authentication Syntax For BlueCoat ProxySG
My Engineering Years: this post is from my early hands-on infrastructure days, kept for reference. See the rest of this era. In this example the syntax used is the "Checkpoint" method. FileZilla Open FileZilla Edit-->Settings...-->FTP-->FTP Proxy-->Click Custom-->Enter the syntax below: USER %u@%s@%h PASS %p@%w Fill in the following: Proxy Host - 123.123.123.123 Proxy User - NTID Proxy Pass - NTPass Click OK to get to the main screen again. Fill in the … [Read more...]