PIX 515E Version 6.1(4) Dropping port scans

[jlepich]

Hello,

Is there a way to configure the PIX to drop hosts that are port scanning hosts behind the firewall? I have a watchguard firebox that when I scan a host behind it, it will drop all connections from the computers that is performing the port scan. Can the PIX do this?

Thanks for any help!

-Jesse

jlepich@pcrmc.com

[wong34539]

Assuming that the host attempting the port scan is sitting on the outside interface, the default benaviour of the PIX firewall is to drop all packets going in unless the PIX is specifically configured to allow the same through. Another thing that you should probably do (and which could be considered to be a good design) is to dynamically NAT all your devices on the inside (if possible). That will make a sucessful attempt at port scanning a lot less fruitful.

[jlepich]

I have multiple servers staticed on my PIX like...

static (dmz,outside) 123.123.123.123 192.168.0.1 netmask 255.255.255.255

then I have only port TCP/80 open to the 123.123.123.123 address.

Hosts on the outside can port scan and see that port 80 is open on the 123.123.123.123 address....with the watchguard as soon as the firewall detects that 123.123.123.123 is being scanned it drops everything from the source to the destination...even it the destination is 123.123.123.123:80...The watchguard firebox aperently has some decently safistcated IDS capibility...I know the PIX does too...I just don't know how to tell the pix to do this.

Thanks for any help!..some documents on this subject would be greatly appriciated.

-Jesse

[gfullage · Accepted solution]

you can use the "ip audit" commands to turn on the IDS functionality in the PIX. The command reference with examples is here:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/gl.htm#1027034

The signatures that the PIX will look for are here:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/syslog/pixemsgs.htm#1032267

Having said all that, the PIX will not be able to detect a port scan and automatically stop all packets from that host. Along with an Network IDS system the PIX can be used to shun packets for over 300 different types of signatures, but by itself it will only check for around 59 signatures (detailed in the link above) and those are generally only one-packet type signatures.

Detecting port scans is best left up to a proper IDS device that is designed to do that, and leave your firewall to do the firewalling.