Re: Determining the FTP culprit
- From: "Phillip Windell" <philwindell@xxxxxxxxxxx>
- Date: Thu, 6 Mar 2008 08:49:29 -0600
"Jim in Cleveland" <JiminCleveland@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:9D29B4ED-26BC-4BDE-9AFE-FAEA20305A24@xxxxxxxxxxxxxxxx
We have ISA 2004 on a Windows Server 2003 box. A few times this month
(once
every other week) our ISP has told us that they had complaints that a node
on
our network is doing an "unauthorized scan or probe" of port 23 on another
a
distant network.
Why are you asking about FTP? Port 23 is Telnet, not FTP.
This happens in the middle of the night on different days
of the week although most have happened on a Saturday night/Sunday
morning.
The report says it is coming from our Firewall server's IP. But since
everything runs thru our Firewall it can be a node on the internal network
too, is this correct?
Can be any host on the LAN.
Can I create an access rule that would deny FTP outbound traffic except
for
certain nodes?
Yes, but since this isn't about FTP,...you need to deal with Telnet.
Is there a report or alert or logging I can run that would narow down FTP
traffic coming from our network and that would narrow down the guilty
node?
if so, how can I set this up?
1. Don't have "wide open" rules that allow users to do whatever they want
and none of this would even happen.
2. The monitoring is "basic 1-2-3" stuff. Use the monitoring Log to locate
connections (or attempts) made to the destiantion IP# during the particular
time frame.
--
Phillip Windell
www.wandtv.com
The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html
Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc
Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------
.
- Prev by Date: Re: Determining the FTP culprit
- Next by Date: Re: router default gateway
- Previous by thread: Re: Determining the FTP culprit
- Next by thread: Re: router default gateway
- Index(es):
Relevant Pages
|
