Hi Team,
If I have many appliances in my network as seen below for example. PC -> WSA -> Firewall1 -> Router -> Firewall2
And a request got blocked in Router or somewhere else. How can I find the exact part when the issue occurred, in another work, how can I know which appliance blocked the request.
There are usually few options depending on the exact behaviour of the network elements. First of all if you are lucky, you get a response packet back with an indication of the blockage (could be ICMP), which has the IP address of the blocking node.
Then if the nodes have management interfaces with statistics of some sort you can consult them directly to see if they increase when you send these blocked packets.
If that doesn't happen you wil have to go get a capture of the various network interfaces of the nodes to see if you can trace the packets that get blocked and see which node receives them but doesn't forward them.
Comments