Network & Infrastructure
A redundant edge routes outbound and return packets through different firewall instances. Each path is individually reachable, but connection state is unavailable where later packets arrive.
Segmentation, TLS & Secure Connectivity2 min read
Read article : Stateful firewall asymmetry after a routing change
Network & Infrastructure
A newly added application permit receives no hits while traffic continues to be denied or unexpectedly allowed elsewhere. An earlier rule may already determine the decision.
Segmentation, TLS & Secure Connectivity1 min read
Read article : Firewall rule shadowing and a permit that never matches
Network & Infrastructure
A firewall rule references the public service address, but the platform evaluates the relevant policy after translation. The expected permit never matches even though NAT counters increase.
Segmentation, TLS & Secure Connectivity2 min read
Read article : NAT and security-policy matching at different processing stages
Network & Infrastructure
Applications intermittently fail to open outbound sessions through a shared egress while existing connections remain usable. The translation pool can run out of usable mappings before bandwidth is exhausted.
Segmentation, TLS & Secure Connectivity2 min read
Read article : SNAT port exhaustion under high outbound concurrency
Network & Infrastructure
A shared HTTPS endpoint serves the wrong certificate or backend for one hostname. IP reachability and port checks pass because the failure depends on the requested server name.
Segmentation, TLS & Secure Connectivity2 min read
Read article : TLS SNI routing and the correct certificate on the wrong backend
Network & Infrastructure
A service works in some browsers but fails on fresh clients or automated agents. Cached intermediates can hide an incomplete chain supplied by the endpoint.
Segmentation, TLS & Secure Connectivity2 min read
Read article : Incomplete TLS certificate chains behind a load balancer
Network & Infrastructure
Two workloads successfully authenticate each other with certificates, yet one receives access beyond its intended role. A valid certificate proves an identity under a trust model, not every permission.
Segmentation, TLS & Secure Connectivity2 min read
Read article : mTLS identity is not the same as application authorization
Network & Infrastructure
A certificate replacement is published, but resumed connections do not exercise the same handshake path as fresh sessions. Monitoring only resumed traffic can miss an invalid replacement bundle.
Segmentation, TLS & Secure Connectivity2 min read
Read article : TLS session resumption and certificate-rotation assumptions
Network & Infrastructure
An API gateway enables early data to reduce connection latency. A state-changing infrastructure request may be unsafe to process under replay conditions even when the connection is encrypted.
Segmentation, TLS & Secure Connectivity2 min read
Read article : TLS 1.3 early data and replay-sensitive infrastructure APIs
Network & Infrastructure
A new site tunnel breaks an existing private route because the two connections cover overlapping source and destination ranges. Tunnel status remains up while packets select an unintended policy.
Segmentation, TLS & Secure Connectivity2 min read
Read article : IPsec traffic-selector overlap and the wrong tunnel choice
Network & Infrastructure
A VPN drops traffic at regular intervals while its tunnel dashboard quickly returns to green. Rekey negotiation or old/new association overlap may be mishandled at those intervals.
Segmentation, TLS & Secure Connectivity2 min read
Read article : IPsec rekey overlap and periodic application interruption
Network & Infrastructure
A VPN works from a public address but fails behind a translated access network. IKE negotiation may begin while the required encapsulated data path or mapping persistence is broken.
Segmentation, TLS & Secure Connectivity2 min read
Read article : IPsec NAT traversal and a tunnel that fails only behind one edge