ACK Tunneling

[admin]

While a reflexive acl theoretically can prevent ack tunneling how would one implement that on the Pix firewalls? Is it more appropriate to apply reflexive acl's on the interior routers?

This question is in regards to the 'newly released Windows 2000 trojan at

http://www.ntsecurity.nu/toolbox/ackcmd/'

[jekrauss]

The PIX firewall stateful packet filtering ensures that a packet received with an ACK will be checked against the existing state table to make sure that the packet is expected. It will check source and destination ip's, port #'s, tcp sequence #'s, and for some applications, the application layer as well.

This capability is implemented automatically on the pix - no additional configuration is required. And no, the pix is the more appropriate place to apply this kind of protection.

HTH

Jeff

[admin]

Please read http://www.ntsecurity.nu/papers/acktunneling/ to understand my concerns.

[rrbleeker]

As Jeff explained, this vulnerability does not apply to PIX firewalls. The PIX checks ALL incoming packets to check it vadility. The article refers to those firewall that check to first (SYN bit set) packet only.