Security

I was right! I suspected that due to the strange crashes and stale connections on some Linksys BEFVP41's were due to some new exploit and it looks like this might be related to it.

http://securitytracker.com/alerts/2006/Jan/1015490.html

Sad but true.
The left side of the graph is from when there were 12 VPN tunnels on one BEFVP41.
The right side of the graph is when 6 of those tunnels were moved to a second BEFVP41.
Next week, both of those units are getting replaced with a Cisco ASA.

I am very surprised how much of a difference there is on the graph overall.
I expected there to be some difference but the overall change is dramatic.

It doesn't help that they haven't upgraded the firmware since 2003 on the V1 and 2005 on the V2, but I suspect the CPU is underpowered or VxWorks's scheduler is allowing some processes/pipes to starve.

I'm seeing strange incoming connections, which typically would be blocked and denied, coming in at an alarming rate on some BEFVP41 V1 devices out there on the internet. Typically trying to get into ports 1024, 1025, and 1026 from very foreign addresses. I don't see the same activity on deployed BEFVP41 V2 devices.

I know they use different hardware and different firmware revisions, so anything is possible, but I haven't seen anything on the web, yet, about any new exploits. I know in the past you could do 'bad things' with the SNMP support. I really wish they hadn't stopped making firmware revisions in 2003 for it.

Ideally I'd love to set them up with a nice set of Cisco ASA/PIX devices and replace all the Linksys but that is just my personal preference for setups like this. If the firmware is unfixable and somehow exploitable, the V1's might have to be replaced anyway.