Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 2 subscribers
  • Views 3710 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Deactivate Port Scan Detection for outgoing traffic from LAN

ChrisW28
Hello,

i have some strange issues with the ASG's PortScan-Detection. If i start to much applications (skype, icq, irc, thunderbird) in a very short time, the ASG blocks all outgoing traffic from my client for around 5 minutes. 

the log's are flooded with entrys like this one: 


2011:10:24-19:02:21 asg ulogd[5473]: id="2102" severity="info" sys="SecureNet" sub="ips" name="portscan detected" action="portscan" fwrule="60017" initf="eth0" outitf="eth1" srcmac="0:15:aa:bb:cc[:D]d" dstmac="ff:ee[:D]d:cc:bb:aa" srcip="192.168.1.101" dstip="1.2.3.4" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="49816" dstport="80" tcpflags="SYN" 


That was a simple HTTP Request, which was blocked by the ASG as portscan ?


This thread was automatically locked due to age.
  • 0
    Hi, you can adjust the portscan and flood sensitivities, or create exceptions, in the Network Security settings.

    Barry
  • 0 in reply to BarryG
    Oh i am sorry, i really missed the configuration options to exclude source networks from the IDS...

    pls close / delete thread.
  • 0
    Hi, further to this, we will exclude the portscan detection from looking at internal networks by binding it to the "internet" only. The idea of PSD is to prevent outside probes from gathering intelligence about open services/ports on your perimeter, and even the effectiveness of using PSD to somehow deny "probers" is one of heavy debate.

    Considering that, it makes sense to just adjust the PSD so it cannot render vital networks as uncommunicative while trying to do a task which many deem as minor anyways; plus preventing PSD's from the inside offers no real security benefit.

    Look for PSD to exhibit this updated behavior beginning with V9 next year. (see? we're listenin [:)])
Unfiltered HTML