Is there any way to bypass the pix from an outside network

[orangel]

Our case goes like this:

In one of inside networks an NT box had a record of an FTP session (Close Wait) from an internet host with a public address. Is there a way in which this host could bypass the pix? The NT box is for internal use only and it is not anounced by any device that contacts the outside networks.

[gfullage]

The PIX will only allow traffic through from the outside if you let it through, so check your ACL/conduits to make sure you're not letting it through. Other than that, the packet could have been spoofed from an internal host to look like it came from an external host. Also check that there's no back-doors into your network around the PIX.