Open DNS showing as attacking new firewall

Joey,

can you show the attacks you see from reports?

Thanks

I see this in the dashboard.  Can you tell me how to drill down more?  It appears to originate inside the network from the DNS Server.

Joey,

if you see the attack, you are using IPS on some firewall rules. Go to Reports > Network & Threats > Intrusion Attacks and find which intrustion attack is matched. Go to the affecting IPS rule and remove the attack pattern.

Please note that XG uses Snort, which is signature-based IPS, so false-positive can occur.

Regards

Joey,

if you see the attack, you are using IPS on some firewall rules. Go to Reports > Network & Threats > Intrusion Attacks and find which intrustion attack is matched. Go to the affecting IPS rule and remove the attack pattern.

Please note that XG uses Snort, which is signature-based IPS, so false-positive can occur.

Regards

Are you talking about this?

I also don't have any deny firewall rules setup.  All are allow.  The XG doesn't seem to add a deny all by default like most firewalls do.

I just checked the firewall rules as well and the #Default_Network_Policy that gets created during the setup does have generalpolicy selected for intrusion detection.

Joey,

check the IPS profile attached to Defaul_Network_Policy and remove the affected IPS pattern (if you think the attack is a false positive).

Regards

Thanks for the reply.  So looking at the policy there it has select all by default which is 9068 signatures.  

It seems the one causing the problem is ISC BIND buffer.c REQUIRE Assertion Failure Denial of Service and  ISC BIND EDNS Option Processing Denial of Service. 

The only way to change it is to change the option to select individual signatures and exclude those but the entire list doesn't populate so I can't seem to select all 9068 minus those two.

Is there a way to just tell the sophos firewall that the IP addresses from OpenDNS are ok and to ignore them from the attackers list?

Thanks again,

Joey

I've got the same issue with "ISC BIND EDNS Option Processing DOS" - Did you find an easy way to ignore this signature or allow the IPs?

thanks

Rich

Sorry,  I honestly can't remember.  I think I ended up calling Sophos and they did something.  I just looked at the firewall and I don't see any modifications to any of the rules or IPS Intrusion settings that would ignore the Open DNS servers.

Later,

J