Solved

LOGS IN A PIX 506

Posted on 2004-09-24
5
233 Views
Last Modified: 2013-11-29
Hello,


  I have a Pix 506, in the syslog server I have these messages:

  data local4.info 192.168.0.212%PIX-6-302002: Teardown TCP connection 19353 faddr 200.221.151.25/4662 gaddr 213.195.79.232/4108 laddr 192.168.0.174/3782 duration 0:00:42 bytes 346 (TCP FINs)

 data local4.info 192.168.0.212%PIX-6-302002: Built UDP connection for faddr 217.115.17.148/13561 gaddr 213.195.79.232/1069 laddr 192.168.0.174/4672


 These are attacks?

 Thank you


0
Comment
Question by:txangu2
  • 2
  • 2
5 Comments
 
LVL 15

Expert Comment

by:Yan_west
ID: 12144518
%PIX-6-302002
This is a connection-related message. This message is logged when a TCP connection is terminated. The duration and byte count for the session are reported. If the connection required authentication, the username is reported in the last field of the message.

TCP FINs The remote server tore down the connection (typical for HTTP or FTP connections)

0
 
LVL 15

Expert Comment

by:Yan_west
ID: 12144524
No, these are not attacks :)
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12144550
Yan is correct, these are certainly  not attacks. They are simply notifications that NAT xlates were built for specific TCP connections, then torn down when the connections closed. Normal behavior.
0
 

Author Comment

by:txangu2
ID: 12148468
ahh ok

 These notifications are from the direction -> Internet -Pix-Lan or Lan-Pix-Internet ?

 If a TCP connection is terminated with the direction Internet-Pix-Lan I don´t understand because I don´t have acl for the outbound interface, and these connections are deny ok?
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 25 total points
ID: 12150347
You don't need a acl. This is normal behavior of the PIX.
If a PC on your lan makes a request of an internet host, for example opens up a browser to www.experts-exchange.com, the PIX creates a nat xlate and waites for the server to respond. When the server completes the transaction (sends all it's stuff) it sends a FIN packet. This tells the PIX that the transaction is comlete and it can tear down the connection.
0

Featured Post

Network it in WD Red

There's an industry-leading WD Red drive for every compatible NAS system to help fulfill your data storage needs. With drives up to 8TB, WD Red offers a wide array of solutions for customers looking to build the biggest, best-performing NAS storage solution.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Can Cisco resolve internet address internally 4 32
Cisco ASA IOS 9.x - no route to host for Internet 4 52
ssh setup on Cisco swith 11 44
syslog id vs. msg 2 20
Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now