Shorewall users - Oct 2004 - (no subject)

Hi, I have shorewall 2.0.8 installed on a linux box.  Recently I moved
to a setup with a front/back firewall 

With shorewall acting as a front firewall and M$ ISA Server 2004 acting
as a back firewall. I turned all ''intrusion alerts''

On at the ISA server expecting not to get any since shorewall should
block everything.

 

Now to the problem:

 

I am getting quite a few alerts on the ISA server, regarding possible
intrusion alerts mainly port scan attempts

and half scan attempts (as ISA names them) by public IP addresses. 

 

Any idea how this could happen? How can packets get thru shorewall?

 

My actual setup is a bit more complicated than described here (involving
some proxy-arped hosts in a DMZ zone and such)

but I feel it still shouldn''t happen.

 

 

Thank you,

 

 

---

Ligiu Uiorean

departament IT - SANEX SA

ligiu.uiorean@ro.lasselsberger.com

tel. +40-740-116.117

Hello Ligiu,

First of all, my knowledge of ISA is very limited, so I don''t know what
it''s refering to with those alerts..

Ligiu A. Uiorean said the following on 08-Oct-04 7:50:
> With shorewall acting as a front firewall and M$ ISA Server 2004 acting
> as a back firewall. I turned all ''intrusion alerts''
> 
> On at the ISA server expecting not to get any since shorewall should
> block everything.
> Now to the problem:
> I am getting quite a few alerts on the ISA server, regarding possible
> intrusion alerts mainly port scan attempts and half scan attempts (as ISA
names them) by public IP addresses.
> 
> Any idea how this could happen? How can packets get thru shorewall?
Probally because you allowed them.... OR because the radiation being 
transmitted by the sun is so intense that shorewall can''t filter
correctly.

But now honestly, you don''t mention anything in regards to your 
configuration, rules etc. How are we suposed to help you?
Please see the url below on how to provide info so ppl can help you.
http://www.shorewall.net/support.htm

-- 
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>