Re: Cisco ASA with Sourcefire -- MIDRANGE-L

× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.

Thanks for the heads up.

I was under the impression that PIX's and ASA's used most of their CPU cycles to destroy and raise havoc on SMTP traffic.

Jerry

On 06/10/16 08:04 AM, DrFranken wrote:

Warning Warning Warning about these dastardly devices.

This is now the third customer who has installed a sourcefire module in their
ASA firewall. It WREAKS HAVOC with IBM i. First customer it totally blew
POWRERHA out of the water. Wouldn't even allow the cluster to start. Sourefire
claimed it was some HP protocol (based on the port number) but didn't meet some
spec and dropped all the packets after packet 1.

Today it was a simple FTP of PTF Images from IBM. A couple got through before
it declared Adobe Acrobat file size out of bounds invalid format byte mismatch
unsynchronized pointer violation error retry limit exception with miscolored
M&Ms. OK I made that last bit up but the net is that MUCH time was wasted
getting bits and parts of the Image files but nearly all the images were
incomplete.

Solution? Add an access rule to the ASA that stops the traffic to and from IBM
i from passing through the sourcefire module. Not sure how those things work but
so far they appear to work badly.

You have been warned.

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.