Unusual port numbers recorded when accessing IIS website through a Reverse Proxy

Hello Experts

A customer of mine has an internal webserver that logs all accesses.  They used to use NAT to allow external access to this webserver and each access was recorded in the IIS logs as coming in on port 443 (correctly).

I have recently deployed an IIS based Reverse Proxy for them (along with DMZ / ASA firewall etc) and now the logs on the internal webserver records the access attempts as coming from the correct customer public IP addresses but on ports other than 443 (see attached image).

Everything seems to be working correctly and the firewall is only allowing 443 access from outside in so I am at a loss at the moment to explain the odd ports in the IIS logs - if anyone can offer a reason for this I would be most grateful.

Thanks.
1.jpg
PlagusAsked:
Who is Participating?
 
Britt ThompsonConnect With a Mentor Sr. Systems EngineerCommented:
I feel this is normal behavior. Access from the client source port will be something random with this setup like outbound access through your ASA to external services. If you watch the logs in the ASA you'll see the same situation reporting client source ports with normal destination ports.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.