Looks to me like packets are winding up on the firewall that shouldn't
be going there and is indicative of a routing problem. The logs seem to
indicate that the pix is being used as a "one-armed router" and that
cannot be done on the PIX. Traffic received on an interface must
traverse the firewall -- i.e. enter and exit on 2 separate interfaces.
Check the route path downstream and see if a misconfiguration exists.
-John
-----Original Message-----
From: sauk0 Listas [mailto:sauk0_s@yahoo.es]
Sent: Tuesday, June 14, 2005 6:12 AM
To: firewalls@securityfocus.com
Subject: pix logs
i have a pix with this errors , what you think about this ?
%PIX-3-106010: Deny inbound tcp src outside:213.98.79.233/2620 dst
dmz:213.98.254.145/135
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.7.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
: %PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src inside:10.100.5.43/80
dst inside:10.100.4.71/2285
%PIX-3-106011: Deny inbound (No xlate) tcp src
outside:213.98.202.19/3959 dst outside:213.58.100.132/139
%PIX-3-106011: Deny inbound (No xlate) tcp src
outside:213.98.202.19/3959 dst outside:213.58.100.132/139
%PIX-3-106011: Deny inbound (No xlate) tcp src
outside:213.98.202.19/3959 dst outside:213.58.100.132/139
: %PIX-3-106011: Deny inbound (No xlate) tcp src
outside:213.98.202.19/3959 dst outside:213.58.100.132/139
%PIX-3-106011: Deny inbound (No xlate) tcp src outside:213.98.9.175/3572
dst outside:213.58.100.132/139
%PIX-3-106011: Deny inbound (No xlate) tcp src outside:213.98.9.175/3572
dst outside:213.58.100.132/139
%PIX-3-106011: Deny inbound (No xlate) tcp src
outside:213.98.195.171/1203 dst outside:213.58.100.132/135
%PIX-3-106011: Deny inbound (No xlate) tcp src
outside:213.98.195.171/1203 dst outside:213.58.100.132/135
%PIX-3-106011: Deny inbound (No xlate) udp src outside:213.58.100.166/1
dst outside:172.27.74.43/137
: %PIX-3-106011: Deny inbound (No xlate) udp src
outside:213.58.100.166/1 dst outside:172.27.74.43/137
%PIX-3-106011: Deny inbound (No xlate) udp src outside:213.58.100.166/1
dst outside:172.27.74.43/137
%PIX-3-106011: Deny inbound (No xlate) udp src outside:213.58.100.166/1
dst outside:172.27.74.43/137 %PIX-3-106011: Deny inbound (No xlate) udp
src outside:213.58.100.166/1 dst outside:172.27.74.43/137
%PIX-3-106011: Deny inbound (No xlate) udp src outside:213.58.100.166/1
dst outside:172.27.74.43/137
etc etc
