Solved

LOGS IN A PIX 506

Posted on 2004-09-24
5
248 Views
Last Modified: 2013-11-29
Hello,


  I have a Pix 506, in the syslog server I have these messages:

  data local4.info 192.168.0.212%PIX-6-302002: Teardown TCP connection 19353 faddr 200.221.151.25/4662 gaddr 213.195.79.232/4108 laddr 192.168.0.174/3782 duration 0:00:42 bytes 346 (TCP FINs)

 data local4.info 192.168.0.212%PIX-6-302002: Built UDP connection for faddr 217.115.17.148/13561 gaddr 213.195.79.232/1069 laddr 192.168.0.174/4672


 These are attacks?

 Thank you


0
Comment
Question by:txangu2
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 15

Expert Comment

by:Yan_west
ID: 12144518
%PIX-6-302002
This is a connection-related message. This message is logged when a TCP connection is terminated. The duration and byte count for the session are reported. If the connection required authentication, the username is reported in the last field of the message.

TCP FINs The remote server tore down the connection (typical for HTTP or FTP connections)

0
 
LVL 15

Expert Comment

by:Yan_west
ID: 12144524
No, these are not attacks :)
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12144550
Yan is correct, these are certainly  not attacks. They are simply notifications that NAT xlates were built for specific TCP connections, then torn down when the connections closed. Normal behavior.
0
 

Author Comment

by:txangu2
ID: 12148468
ahh ok

 These notifications are from the direction -> Internet -Pix-Lan or Lan-Pix-Internet ?

 If a TCP connection is terminated with the direction Internet-Pix-Lan I don´t understand because I don´t have acl for the outbound interface, and these connections are deny ok?
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 25 total points
ID: 12150347
You don't need a acl. This is normal behavior of the PIX.
If a PC on your lan makes a request of an internet host, for example opens up a browser to www.experts-exchange.com, the PIX creates a nat xlate and waites for the server to respond. When the server completes the transaction (sends all it's stuff) it sends a FIN packet. This tells the PIX that the transaction is comlete and it can tear down the connection.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
Make the most of your online learning experience.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…

632 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question