This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Attempting to block IP generating portscan and intrusion alerts

ASG 220 with 7.201.
A particular IP address has been generating a lot of port scan and intrusion alerts (Message........: WEB-IIS iisadmin access)
It's filling up my inbox so I thought I would just drop all packets from that IP with a pf rule (Source the ip, service, any, destination, internal network) but I am still getting periodic floods of alerts.

Whats the best approach to these issues anyway?

This thread was automatically locked due to age.

Parents

0 BarryG over 17 years ago

Did you put that rule above any related ALLOW rules?

You don't have the http proxy allowing outside traffic in, do you?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 mrainey over 17 years ago in reply to BarryG

Did you put that rule above any related ALLOW rules?

You don't have the http proxy allowing outside traffic in, do you?

Barry

I moved the drop rule to the top. Not sure what you mean about the http proxy. Under web security, http, global, allowed networks has only internal subnets.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 17 years ago in reply to mrainey

Sounds good.

Are the alerts gone now?

Portscans might still show up as they could be detected even if you don't allow the traffic through the fw.
Other IPS alerts should go away, I believe.

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BarryG over 17 years ago in reply to mrainey

Sounds good.

Are the alerts gone now?

Portscans might still show up as they could be detected even if you don't allow the traffic through the fw.
Other IPS alerts should go away, I believe.

Barry
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 mrainey over 17 years ago in reply to BarryG

Yes, the IPS alerts have gone away. I am used to seeing port scans from China, Belgium and places like that. THis one was from the USA and I just found out it was from a legit security company hired to do penetration testing unbeknown to me.
Cancel
Vote Up 0 Vote Down

Cancel