The H3C Security Management Platform running on H3Linux―H3C proprietary Linux operating system
H3Linux是基于CentOS进行封装的，所以安装过程和CentOS基本一致（CentOS操作系统最小化安装部署）
Friday, March 8, 2024
Hillstone A Series NGFW Highlight and resource
Hillstone A Series NGFW Highlight
- High performance
- Full security protection
- SD-WAN ready
- ZTNA ready
- Twin-mode for Active-Active data center
- Load balancing(Link, server)
- Advance Qos(iQOS)
- Intelligent Threat Detection in Encrypted Traffic Without Decryption
- ML-based Food Protection Baseline Establishment
- Smart policy operation(policy auto-learning, policy auditing, policy hit analysis, redundancy check, log visibility, hotfix support)
FAQ
Does Hillstone provide a centralized management system?
Yes, HSM (Hillstone Security Management) centrally controls and manages multiple Hillstone devices in the network, providing the below capabilities
NGFW Manager - This module provides basic O&M management for firewalls, including:
Status Monitor: View the online status and HA status of devices;
Configuration Deployment: Manage security policies and destination-based routes for devices;
O&M Management: Implement device image update, signature database update, and configuration file management.
Policy Analyzer - To solve security policy review issues for multiple devices, Policy Analyzer of HSM can be used as a visual management platform. This platform helps you review the security policies of multiple devices, finds abnormal policies or non-compliant policies, and then provides a detailed analysis report.
How Hillstone integrates with CyberArk?
Hillstone HSM and NGFW support AAA servers such as the Radius server or LDAP server. CyberArk can integrate with the AAA server for privileged account management and password management for Hillstone HSM and NGFW.
Does Hillstone's default routing administrative distances align with Cisco or Huawei?
Hillstone default routing administrative distances aligns with Cisco.
Hillstone NGFW model supports 10G IPsec VPN
Hillstone NGFW SG-6000-A3800-IN provides IPsec VPN throughput of 12 Gbps and two SFP+ interfaces.
How does Hillstone handle when some interface's traffic almost reaches or exceeds the maximum bandwidth of the link?
Hillstone supports shaping mode and policing mode for traffic control when traffic excessed. With shaping mode, traffic shaping retains the excessed packets in a queue and then schedules the excessed traffic by increasing the latency. While with policing mode, the system will drop the traffic that exceeds the bandwidth limit.
Resource (please create an account to log in)
Hillstone Official Website
Hillstone User Center
Technical Documentation
CN Version: https://docs.hillstonenet.com/
Knowledge Base
CN Version: https://kb.hillstonenet.com/cn/
Software Download
CN Version: https://images.hillstonenet.com/
Hillstone StoneOS 5.5R10 Documentation
Tuesday, March 5, 2024
How to resolve the login failed after Cisco Anyconnect client update via Cisco ASA connection
In the previous post https://billyfung2010.blogspot.com/2024/03/how-to-enable-cisco-asa-anyconect.html
There are solution to upgrade the Cisco Anyconnect client, but after the upgrade. It is failed to login.
The error message is "Login Failed".
The solution is Reboot the client machine. E.g. Windows laptop
It will establish a new connect to Cisco ASA.
The reason is without reboot the machine, the new client will use the same session to reconnect to ASA. But that session is being interrupted for upgrade. So, it cannot reconnect until the session being expired after 30 mins.
Reference:
If anyconnect session is interrupted, he fails to connect due to IP conflict during 30m
When a user cannot connect the AnyConnect VPN Client to the ASA, the issue might be caused by an incompatibility between the AnyConnect client version and the ASA software image version. In this case, the user receives this error message: The installer was not able to start the Cisco VPN client, clientless access is not available. In order to resolve this issue, upgrade the AnyConnect client version to be compatible with the ASA software image. When you log in the first time to the AnyConnect, the login script does not run. If you disconnect and log in again, then the login script runs fine. This is the expected behavior. When you connect the AnyConnect VPN Client to the ASA, you might receive this error: User not authorized for AnyConnect Client access, contact your administrator. This error is seen when the AnyConnect image is missing from the ASA. Once the image is loaded to the ASA, AnyConnect can connect without any issues to the ASA. This error can be resolved by disabling Datagram Transport Layer Security (DTLS). Go to Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles and uncheck the Enable DTLS check box. This disables DTLS. The dartbundle files show this error message when the user gets disconnected: TUNNELPROTOCOLDPDMGR_ERROR_NO_DPD_RESPONSE:The secure gateway failed to respond to Dead Peer Detection packets. This error means that the DTLS channel was torn due to Dead Peer Detection (DPD) failure. This error is resolved if you tweak the DPD keepalives and issue these commands: webvpn svc keepalive 30 svc dpd-interval client 80 svc dpd-interval gateway 80 The svc keepalive and svc dpd-interval commands are replaced by the anyconnect keepalive and anyconnect dpd-interval commands respectively in ASA Version 8.4(1) and later as shown here: webvpn anyconnect ssl keepalive 15 anyconnect dpd-interval client 5 anyconnect dpd-interval gateway 5
Friday, March 1, 2024
Symantec Endpoint Protection (SEP) being restarted automatically on Linux
If you run the following command to stop and disable the SEP:
systemctl stop sisamddaemon
systemctl disable sisamddaemonThe SEP will restart itself later.
For SEP Linux agent version 14.3 RU1 and above, you can stop the SEP Linux agent using the ./stop.sh command in /usr/lib/symantec folder.
However, as per product design, stopping SEP Linux agent is not permanent. Services will be resumed if the Linux machine is restarted.
If you ./stop.sh without reboot. The SEP Linux services will remain fully stop until it is startup using ./start.sh command or on the next system reboot.
The only way to permanently stop the SEP service is uninstall it or temporary ./stop.sh without reboot the system.
How to restart the Endpoint Protection Linux daemons
https://knowledge.broadcom.com/external/article/151271/how-to-restart-the-endpoint-protection-l.html
How to enable Cisco ASA anyconect client upgrade when they installed early version and connect to Cisco ASA firewall?
Solution: When upgrade the Cisco ASA firewall, upload the latest version of Cisco anyconnect client to ASA (Conifg>RemoteVPN>AnyconnectClientSoftware), and make the latest anyconnect client image top of the list.
Reference:
Subscribe to:
Posts (Atom)