PIX UPD port 1433/1434

[abbas.ali]

Lot of companies have been hit by SQL 2 virus regardless of having a PIX in

their networks. I am just curios,if by default all packets are denied from

outside to inside unless one opens it manually through

conduit/access-list,what is it good to apply access-list to block such port

1433 and 14342)

Shouldn't these ports are disabled by default since

traffic is coming from outside. If it is then how the virus entered the

network.

Please shed some lights.

[carl.newman]

Hello:

You are correct. The pix will not allow a connection from and outside interface that is not implictly allows via a conduit or acl. The pix uses what is called an ASA. The ASA is a set of rules that PIX code uses to base default configuration rules on.

One of the golden rules is that no connections from a lower secuirty level to a higher security level will be allowed. The Conduit or ACL will cause the pix to ignore the ASA for conduit or ACL.

Hope it helps.

Carl