[fw-wiz] PIX 6.3.3 and UDP connections

From: Smith Bruce (BruceS_at_petech.ac.za)
Date: 09/30/03

  • Next message: Frank Darden: "RE: [fw-wiz] @Stake CTO fired for Microsoft comments" 
    To: <firewall-wizards@honor.icsalabs.com>
Date: Tue, 30 Sep 2003 09:18:48 +0200

    Good day

    We've got what may or may not be a problem. If we do a show conn on the
    running PIX, we get hundreds of entries for UDP connections to our DMZ
    protected DNS servers on port 53. We have a setup for the DNS servers
    where the PIX translates from the outside address to the subnet that the
    DMZ runs. If we restart the devices, the connections return quickly.

    Is this normal behavior for a PIX, are we under some sort of attack or
    have we just misconfigured something?

    Regards

    Bruce Smith

    Firewall Administrator.

    Snapshot of the show conn output follows

    UDP out 61.143.182.121:53 in 196.21.198.101:41035 idle 0:00:01 flags -

    UDP out 61.143.182.121:53 in 196.21.198.101:41035 idle 0:00:01 flags -

    UDP out 61.143.182.121:53 in 196.21.198.101:41035 idle 0:00:01 flags -

    UDP out 61.143.182.121:53 in 196.21.198.101:41035 idle 0:00:01 flags -

    UDP out 61.143.182.121:53 in 196.21.198.101:41035 idle 0:00:01 flags -

    UDP out 61.143.182.121:53 in 196.21.198.101:41035 idle 0:00:01 flags -

    UDP out 61.143.182.121:53 in 196.21.198.101:41035 idle 0:00:01 flags -
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Frank Darden: "RE: [fw-wiz] @Stake CTO fired for Microsoft comments"

    Relevant Pages

    • Re: A Tale of Two PIXes
      ... From the inside interface, the PIX attaches to out 6509 ... and there is no DMZ. ... >working through the 4MB connection. ...
      (comp.dcom.sys.cisco)
    • [fw-wiz] Double firewall setup (long)
      ... One PIX 515E w/ 3 interfaces: inside, outside, DMZ. ... access-list OUTB permit tcp 10.181.8.0 255.255.248.0 any eq www ... interface ethernet0 auto ...
      (Firewall-Wizards)
    • RE: [fw-wiz] PIX 520 - control traffic between DMZ and inside devices
      ... The Nat 0 rule should be used for the internal server. ... This will allow trafic to traverse the PIX from ... Assuming you have the Server Statically mapped to an external Address: ... PIX 520, Three interfaces - inside, Outside and DMZ. ...
      (Firewall-Wizards)
    • RE: [fw-wiz] PIX 520 - control traffic between DMZ and inside devices
      ... If you are going from a lower security level to a higher ... This will allow trafic to traverse the PIX from ... PIX 520, Three interfaces - inside, Outside and DMZ. ... I cannot ping any inside devices from the PIX "DMZ" interface ...
      (Firewall-Wizards)
    • Re: Problems configuring my PIX525
      ... I am almost sure that Cisco ... > offers some kind of training for the PIX. ... DMZ should be 192.168.x.x, again you have the wrong subnet mask - change ... and static is only used for incoming connection. ...
      (comp.security.firewalls)