Re: PIX Log Interpretation Help

On Tue, 2006-06-27 at 14:53 -0700, Robert McIntosh wrote:
> Jun 26 15:21:06 10.0.0.6 %PIX-4-106023: Deny tcp src
> outside:xxx.xxx.xxx.xxx/25 dst inside:xxx.xxx.xxx.xxx/21100 by
> access-group "inbound"
> Jun 26 15:21:09 10.0.0.6 %PIX-4-106023: Deny tcp src
> outside:xxx.xxx.xxx.xxx/25 dst inside:xxx.xxx.xxx.xxx/21100 by
> access-group "inbound"
>
> I don't understand why the external mail host would be trying to
> connect on port 21100 on our firewall. 

Looks like a state time out issue. This happens more frequently with
TCP/80, but I have seen it on SMTP as well. 

Usually what causes it is one side of the connection issues a FIN/ACK to
end their side of communications, thus entering a half closed state.
When the firewall sees the FIN/ACK, it drops the state timer to
something small (usually 30-120 seconds, depending on the firewall). If
communications do not complete in this time, the firewall kills the
session. This causes all remaining communications in that session to be
denied.

To verify if this is the case, look earlier in your logs to see if your
mail server connected to this external host from TCP/21100 going to
TCP/25. If you find that log entry, its just the timers giving you
trouble. 

HTH,
Chris