Welcome to ISAserver.org

The Intrusion Detected Warning Alert Was Signaled

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 General ] >> General >> The Intrusion Detected Warning Alert Was Signaled

Page: [1]

Message

<< Older Topic Newer Topic >>

The Intrusion Detected Warning Alert Was Signaled - 26.Aug.2008 1:10:27 PM

jsclmedave

Posts: 3
Joined: 26.Aug.2008
Status: offline

ISA 2004 - Server 2003 Standard SP2

I am seeing these alerts about every 5 min's -

*NOTE* I changed the orig IP address.

Events that triggered the alert: 8/26/2008 3:41:17 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:44:45 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:48:17 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:52:19 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:56:20 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)

1) They do not have an Exchange Server in their site, it is hosted from a 3rd party
2) The Original IP address does resolve to - owa.3rdparty.com

Since they do not host their own Exchange I don't see a reason to perform the steps in http://www.isaserver.org/articles/2004owapub.html .

Can some one confirm this? I "think" this error can be ignored or better yet how do I fix it,,, if possible.

The link above is when you have the Exchange box onsite, not hosted. Does it matter?

Thanks in advance!

_____________________________

Tim

Post #: 1

Featured Links*

RE: The Intrusion Detected Warning Alert Was Signaled - 26.Aug.2008 7:05:38 PM

Jason Jones

Posts: 2121
Joined: 30.Jul.2002
From: United Kingdom
Status: offline

I think I am misssing something here, as I see no relation to Exchange, so why is this involved?

Cheers

JJ

_____________________________

Jason Jones (MVP)

Silversands Limited http://www.silversands.co.uk
My Blog: http://blog.msfirewall.org.uk/

Get our NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to jsclmedave)

Post #: 2

RE: The Intrusion Detected Warning Alert Was Signaled - 11.Sep.2008 9:26:42 AM

jsclmedave

Posts: 3
Joined: 26.Aug.2008
Status: offline

Sorry for the delay in posting.

Reason -

I am seeing these alerts about every 5 min's -

*NOTE* I changed the orig IP address.

Events that triggered the alert: 8/26/2008 3:41:17 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:44:45 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:48:17 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:52:19 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:56:20 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)

The IP resolves back to THEIR 3rd party Exchange Host - their OWA service IP to be exact. So I am not sure if something needs to be opened or if these alerts can be ignored.

They are upgrading to Exchange 2007 with OCS in the very near future so this issue may once again arise.

I just was not sure if the alerts could be ignored or not.

(in reply to Jason Jones)

Post #: 3

RE: The Intrusion Detected Warning Alert Was Signaled - 15.Sep.2008 4:15:42 PM

gazy007

Posts: 26
Joined: 29.Aug.2008
Status: offline

I get the similar message but different IP addresss. I acknowledge it and reset it.

quote:

ORIGINAL: jsclmedave

Sorry for the delay in posting.

Reason -

I am seeing these alerts about every 5 min's -

*NOTE* I changed the orig IP address.

Events that triggered the alert: 8/26/2008 3:41:17 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:44:45 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:48:17 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:52:19 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)
address 216.216.190.0. 8/26/2008 3:56:20 AM - ISA Server detected an all port scan attack from Internet Protocol (IP)

The IP resolves back to THEIR 3rd party Exchange Host - their OWA service IP to be exact. So I am not sure if something needs to be opened or if these alerts can be ignored.

They are upgrading to Exchange 2007 with OCS in the very near future so this issue may once again arise.

I just was not sure if the alerts could be ignored or not.