Good point. I asked about this when having them make the changes but I'm not sure if they even knew! But if that's all that's needed, I can have them look into it when we try rolling this out again across subnets. I think they may be using a mix of branded firewalls but I know at least Checkpoint is one.
On Tue, Dec 8, 2009 at 6:15 PM, Jeremy Rossi <[email protected]> wrote: > This is odd. I don't know the firewalls that you are using, but I am > guessing they are not keeping a state table http://j.mp/78bHjA. This state > table would be needed due to the dynamic ports selected OSSEC on the agent > side of the connection. > > OSSEC works by having the agent contacting the server on UDP port 1514 and > the src port will be picked randomly. > > Can you give me some more details on the firewall's used? > > -Jeremy > > On Dec 8, 2009, at 6:01 PM, jplee3 wrote: > > > Hey guys, > > > > I found something interesting in attempting to deploy OSSEC in agent/ > > server model. Not sure what the implications are here, but it seems > > like 1514 isn't the only port OSSEC retains communication over (since > > it's UDP I think?). > > > > The firewall rules that I'm working with are very restrictive. And UDP > > is also restricted. I requested that 1514 UDP be opened on both the > > server and agents but still couldn't get OSSEC to communicate between > > the agents/servers. > > > > After running a tcpdump, I found this: > > > > 18:24:49.215025 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto > > UDP (17), length 93) 10.x.x.x.1514 > 216.x.x.x.43591: UDP, length 65 > > > > > > So it seems the server was sending a request to the destination where > > the destination port is dynamic. > > > > > > Is there something I'm missing here? > > > >
