topic Re: Failing inbound connection through a PIX in Network Security

Failing inbound connection through a PIX

anowell — Mon, 11 Mar 2019 09:38:45 GMT

My public IP address changed for my Road Runner connection so I adjusted my access-list and static NAT statements to reflect the change so users could connect to a FTP server on the Inside of my network. After making the changes I?m now getting a log message I?ve never seen and I was curious if anyone had.

106001: Inbound TCP connection denied from 60.223.142.199/40169 to 23.209.122.20/19999 flags SYN on interface outside

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

My config:

PIX Version 6.3(5)

object-group service FTP_Port tcp

port-object eq 19999

access-list outside permit tcp any host 23.209.122.20 object-group FTP_Port

ip address outside dhcp setroute (My IP is 23.209.122.20)

ip address inside 10.10.10.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

global (outside) 1 interface

nat (inside) 1 10.10.10.0 255.255.255.0 0 0

static (inside,outside) tcp 23.209.122.20 19999 10.10.10.150 ftp netmask 255.255.255.255 0 0

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

This is what I get from Cisco.

Error Message %PIX-2-106001: Inbound TCP connection denied from IP_address/port to

IP_address/port flags tcp_flags on interface interface_name

Explanation: This is a connection-related message. This message occurs when an attempt to connect

to an inside address is denied by your security policy. Possible tcp_flags values correspond to the

flags in the TCP header that were present when the connection was denied. For example, a TCP

packet arrived for which no connection state exists in the PIX Firewall, and it was dropped. The

tcp_flags in this packet are FIN and ACK.

The tcp_flags are as follows:

? ACK?The acknowledgment number was received.

? FIN?Data was sent.

? PSH?The receiver passed data to the application.

? RST?The connection was reset.

? SYN?Sequence numbers were synchronized

? URG?The urgent pointer was declared

Recommended Action None required.

Re: Failing inbound connection through a PIX

acomiskey — Tue, 27 Feb 2007 03:06:50 GMT

try...

static (inside,outside) tcp interface 19999 10.10.10.150 ftp netmask 255.255.255.255

and

access-list outside permit tcp any interface outside object-group FTP_Port

Re: Failing inbound connection through a PIX

anowell — Tue, 27 Feb 2007 03:12:34 GMT

I replaced my line with the one you gave but got the same result. Any other ideas?

Thanks in advance!

Re: Failing inbound connection through a PIX

Jon Marshall — Tue, 27 Feb 2007 07:58:43 GMT

When you changed the translation did you clear the xlate entry for it ?

Jon

Re: Failing inbound connection through a PIX

anowell — Tue, 27 Feb 2007 11:53:59 GMT

Yes, I did but had the same error.

Re: Failing inbound connection through a PIX

Jon Marshall — Tue, 27 Feb 2007 12:20:35 GMT

Sorry for the basic stuff but how many lines are there in your access-list that is applied to the outside interface ?

Jon

Re: Failing inbound connection through a PIX

armin.kraus — Tue, 12 Jun 2007 11:02:27 GMT

Hi,

i have the same error with a my pix running version 7.2.2. Did you solve the problem, or have you any suggests for me?