Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 2 subscribers
  • Views 2030 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Strange IPS warnings since today

PSyc
Hello all,

since today the IPS has some strange detections and I receive periodically the notifications, until now approx. 130.

Unfortunately I can't figure out what the problem is.

---
Subject: [GQDN Gateway][WARN-850] Intrusion Prevention Alert

Intrusion Prevention Alert

Details about the intrusion alert:

Message........: ICMP Microsoft remote unauthenticated DoS/bugcheck vulnerability
Details........: Snort ::
Time...........: 2012:05:21-16:02:07
Packet dropped.: no
Priority.......: medium
Classification.: Attempted Denial of Service
IP protocol....: 1 (ICMP)

Source IP address: ***.***.***.1 (gateway)
Source port: 0
Destination IP address: ***.***.***.201 (FQDN Server)
Destination port: 0
---

System Version is 8.302.

I receive this notifacations for two server ***.***.***.200 and .201. Both servers are configured as DC and DNS.

Why the Astaro is initiating such requestes on Port 0?

Thoughts, comments, solutions are much appreciated.

Many thanks.

PSyc


This thread was automatically locked due to age.
Parents
  • 0
    Why the Astaro is initiating such requestes on Port 0?

    SSL VPN is active

    I think that's the answer.

    2. The masq rule shouldn't be necessary.  The mistake in 3 is usually the reason people have it.  Try disabling this masq rule.

    If that doesn't fix the problem, the easiest would be to disable the Snort rule or create an exception for Source = "Internal (Address)" and Destination = Group of DCs.

    Cheers - Bob
Reply
  • 0
    Why the Astaro is initiating such requestes on Port 0?

    SSL VPN is active

    I think that's the answer.

    2. The masq rule shouldn't be necessary.  The mistake in 3 is usually the reason people have it.  Try disabling this masq rule.

    If that doesn't fix the problem, the easiest would be to disable the Snort rule or create an exception for Source = "Internal (Address)" and Destination = Group of DCs.

    Cheers - Bob
Children
No Data