Port Scans

[jw]

I have read and re-read the PIX 515E docs and do not see a way to block port scans or limiting the number of connections per IP. I know other firewalls will permit the limiting of connections from a source IP and will also block the IP's if it detects a port scan. Any suggestions would be appreciated.

[jmia]

Jeff,

What are you trying to do, are you trying to block IP address range or stop port scaning activities? If you are trying to stop port scaning then in config mode issue:

icmp deny any outside

and save with write mem

Go to www.grc.com and try the 'ShieldsUp' tool before and after you apply the above statement.

Hope this helps

Jay

[jmia]

Jeff,

What are you trying to do, are you trying to block IP address range or stop port scaning activities? If you are trying to stop port scaning then in config mode issue:

icmp deny any outside

and save with write mem

Go to www.grc.com and try the 'ShieldsUp' tool before and after you apply the above statement.

Hope this helps

Jay

[davecs]

no offense but that wont do jack.

any hacker/cracker will be smart enough to turn of ping probing first.

a PIX cant really do this kind of activity - you could script up something which looks at logs and issues shun commands to the PIX - but its not in the PIX's scope.

maybe look at a IDS solution too!

[paulsa3598]

The shun command should take care of your problem. But this could cause problems if spoofs have your own IP address range. (Normally you wouldn't go out to come back in again. The PIX also comes with IDS.

[ditscap]

"icmp deny any outside"

That blocks ICMP destined for the outside interface, not the internal network.

[jmia]

Jeff,

What are you trying to do, are you trying to block IP address range or stop port scaning activities? If you are trying to stop port scaning then in config mode issue:

icmp deny any outside

and save with write mem

Go to www.grc.com and try the 'ShieldsUp' tool before and after you apply the above statement.

Hope this helps

Jay