topic Re: CSA 5.0 LOG in Network Security

CSA 5.0 LOG

guest — Sun, 10 Mar 2019 10:56:04 GMT

I have production server which as CSA5.0 installed, I get this error message flagged on CSA. It is managed via MC 5.0.

attempted to accept a connection as a server on TCP port 445 from 10.9.2.3. The operation was denied.

Is there way to set this rule in policies and attach to group so that https is allowed and not blocked to this server.

THANKS

Muhammad

Re: CSA 5.0 LOG

tsteger1 — Tue, 08 Jan 2008 19:08:30 GMT

Hi Muhammad,

First, confirm you want to allow this server to share resources. 445 is Microsoft-DS (SMB shares), not HTTPS.

If so, either create a network address set and use it with a Network Access Control allow rule or add the IP address to an allow rule for TCP/445.

Tom

Re: CSA 5.0 LOG

guest — Tue, 08 Jan 2008 21:41:50 GMT

Thanks Tom,

Basically it is sql database replication and updates to other server.

Could you pls guide me step by step to create and allow this rule if possible.

kind regards,

muhammad

Re: CSA 5.0 LOG

tsteger1 — Wed, 09 Jan 2008 00:49:36 GMT

Hi Muhammad, use the Event Management Wizard on the alert and that should guide you through creating the rule.

It should create a NAC rule allowing 445 traffic to the app (listed in the alert) on the server and you can choose the addresses you want to allow.

Check the rule it creates to confirm it is not too broad in allowing 445 traffic as that is a popular attack vector.

Tom

Re: CSA 5.0 LOG

guest — Wed, 09 Jan 2008 09:23:10 GMT

Thanks Tom, just quick one, how can i push this rule to all the hosts. Do i have to reset the hosts from MC or each time CSA polls and get the new config.

thanks in advance,

muhammad

Re: CSA 5.0 LOG

tsteger1 — Thu, 10 Jan 2008 18:06:06 GMT

Just create the rule and make sure it is associated with the rule module/policy/group and the hosts will get it.