PIX 515E and Symantec FW

Date: 09/22/05

Date: 22 Sep 2005 05:04:08 -0700

Dear all,
we have installed a PIX 515 Ver. 6.3 behind our enterprise wide FW from
To explain our problem let' take this example:
We are allowing HTTP access only for hosts from our own company LAN.
Therefore any HTTP request from OUTSIDE is rejected as we can see it in
our log. That' fine BUT 2 or 3 minutes later the same request from the
same outside client is accepted because we see at the OUTSIDE interface
now the IP address of our Symantec FW which we trust.
Very strange!
Is there any explanation why this happens?

THX for your help!
Rainer B.