topic PIX logging messages in Network Security

PIX logging messages

tmcmillion — Fri, 21 Feb 2020 07:47:09 GMT

We have what I would consider to be some abnormal behavior on one of my mail servers. The server admins says everything is OK but I disagree. I have a whole bunch (100 or so) per minute of the following series of entries in my PIX log file from this Server. Is this normal behavior?

%PIX-6-302013: Built outbound TCP connection 40391293 for outside:68.216.187.33/25 (68.216.187.33/25) to DMZ:172.23.5.9/3989 (65.196.5.9/3989)

%PIX-6-106015: Deny TCP (no connection) from 68.216.187.33/25 to 65.196.5.9/3989 flags RST on interface outside

%PIX-6-302014: Teardown TCP connection 40391293 for outside:68.216.187.33/25 to DMZ:172.23.5.9/3989 duration 0:00:01 bytes 324 TCP Reset-O

Re: PIX logging messages

nkhawaja — Sun, 05 Dec 2004 05:37:05 GMT

No, this doesnt seem normal. Seems like server at 172.23.5.9 is trying to send emails but the connections gets dropped because PIX is seeing RST packets. Is this MS exchange server? do you have fixup smtp disabled?

what version of PIX

any thing changed?

Thanks

Nadeem

Re: PIX logging messages

tmcmillion — Mon, 06 Dec 2004 14:28:54 GMT

This is POP server used for relaying. fixup smtp is not disabled and there have been know chnages on the PIX. I came across this problem while helping one the server admins troubleshoot a problem with the server.