problem:
With Packet Filter set to Any-ANY-Any.
FTP Proxy Off
(this also occurs with Packet Filter no rules and just the FTP Proxy ON)
(this also occurs with the FTP Application set to PASV)
If I start a FTP upload (larger than 3 megs) Then
if i then go to Network Security | Intrusion Protection, uncheck ALL attack patterns, turn off ALL Anti-DoS/Flooding, turn off Anti-Portscan and turn on the Global IPS for my inner network .... after about 3 megs the FTP application (Fetch) shows the upload speed slow down (about .4KB/s every refresh) then it will show "stalled". At about the same time it showed "stalled" I get these messages in the Live Log (of the Global IPS):
2007:01:27-09:34:52 (none) barnyard[15614]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="P2P Edonkey file segment transfer" group="702" srcip="192.168.2.90" dstip="72.41.255.218" proto="6" srcport="50342" dstport="20" sid="90006" class="Potential Corporate Privacy Violation" priority="1" generator="1" msgid="0"
2007:01:27-09:35:20 (none) barnyard[15614]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="P2P Edonkey hallo" group="702" srcip="192.168.2.90" dstip="72.41.255.218" proto="6" srcport="50421" dstport="55709" sid="90007" class="Potential Corporate Privacy Violation" priority="1" generator="1" msgid="0"
(it repeats this log entry about 1 every minute (looks like 46 seconds? it changes)
(is there any way to access the "Corporate Privacy" rules??)
The speed of the upload continues do decline (which can take like 10 painful minutes as my speed reduces to 1 KB/s at about a loss of .1 KB/s per 5 seconds ... ug), I continue to get these messages, until the Live Log shows what looks to me like the IPS restarting (the text output was too long for this post)
???
workaround:
the way i work around this is by creating an exception under the Exceptions for my entire network:
Skipping: Intrusion Protection / Anti-Portscan / Anti-DoS/Flooding TCP / Anti-DoS/Flooding UCP / Anti-DoS/Flooding ICMP
For:
Source networks
Internal (Network)
Destination networks
Internal (Network)
Anyone able to reproduce this? Any helps?
THANK YOU!
This thread was automatically locked due to age.
