High session through PIX 515E firewall

[thaier1978]

My ISP is stopping the internet service and says that I have a high session count of 5400+.. The normal session counts should be around 200. Due to this high count, my site can potentially cause harm to my network and thier network. they have deactivated this site to prevent harm.

MY PIX config is attached, please check it.

note: my ISP modem have IP of 216.147.153.113 /29

if you have any questions please contact me through Email or messenger in below contacts , I appreciate your help in advance.

thank you,

Thaier K. Cassim

Iraq - Baghdad

Cell Phone: +964 7901 762691

yahoo ID: <A HREF="mailto:thaier78@yahoo.com">thaier78@yahoo.com</A>

MSN ID: <A HREF="mailto:thaier78@hotmail.com">thaier78@hotmail.com</A>

Email: <A HREF="mailto:thaier78@yahoo.com">thaier78@yahoo.com</A>

[sachinraja · Accepted solution]

Hi thaier,

saw the configs.. why are you opening ip any any and tcp any any from inside to outside.. first remove these statements and then see the performance.. am sure most of the unnecessary traffic are going through now because of these statements....

no access-list inside_access_in permit ip any any

no access-list inside_access_in permit tcp any any

see if this solves the problem.otherwise we have to finetune the remaining access-lists.. make sure all ports are open after you remove these 2 lines...

Raj

[thaier1978]

Dear Raj,

Can I put limitation for the sessions that are going through the openned ports using the PIX 515E firewall?

Or, can I put limitation for each PC?

Thank you,

Thaier

[thaier1978]

How can I know the required ports for my application if I have one not using the port 80?

Thank you,

Thaier

[nataraj_v · Accepted solution]

Dear Thaier ,

I feel , check ur PAT table once. is there any internal systems generating more connections on virus ports . u enabled ip any any which is not good.remove them and make sure all the required ports opened or not.

Thanks and regards

Nataraj