Welcome to ISAserver.org

Wierd Person listed in sessions

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 Firewall] >> Firewall Client >> Wierd Person listed in sessions

Page: [1]

Message

<< Older Topic Newer Topic >>

Wierd Person listed in sessions - 20.Jun.2002 12:03:00 AM

kendal

Posts: 7
Joined: 29.May2002
From: Las Cruces, NM
Status: offline

OK, I have a very wierd, and annoying, and possibly BAD situation.

I was looking at my ISA server today, and found an IP address that is not one of ours in the session list as a firewall client. I did some checking and found that this IP is on a DSL line on Bell South's network. I need to block this immediately, and keep it from happening again. I have Tom's book coming in, but I don't think I can wait until it gets here to fix this.

Any ideas, please post here, or reply in emial to kemery@coordinatedhomecare.com

Thanks very much

Kendal

Post #: 1

Featured Links*

RE: Wierd Person listed in sessions - 20.Jun.2002 4:46:00 PM

tshinder

Posts: 47669
Joined: 10.Jan.2001
From: Texas
Status: online

Hi Kendal,

Sounds like a possible LAT problem. Include only the addresses on your internal network on the LAT.

HTH,
Tom

(in reply to kendal)

Post #: 2

RE: Wierd Person listed in sessions - 20.Jun.2002 5:09:00 PM

kendal

Posts: 7
Joined: 29.May2002
From: Las Cruces, NM
Status: offline

quote:
Originally posted by tshinder:
Hi Kendal,

Sounds like a possible LAT problem. Include only the addresses on your internal network on the LAT.

HTH,
Tom

I am pretty sure the LAT is set right, but I will check it again. Also, a little more information, according to the logs, he isn't really getting anywhere. Everything is denying him because of policy. I still don't like the fact that he got that far, but at least he doesn't seem to be doing any damage. I am hoping when your book gets in, it will help me resolve this issue, as well as a few others. I haven't done too bad for not knowing a lot about ISA when I started.

Kendal

(in reply to kendal)

Post #: 3

RE: Wierd Person listed in sessions - 20.Jun.2002 5:14:00 PM

kendal

Posts: 7
Joined: 29.May2002
From: Las Cruces, NM
Status: offline

quote:
Originally posted by tshinder:
Hi Kendal,

Sounds like a possible LAT problem. Include only the addresses on your internal network on the LAT.

HTH,
Tom

I just checked my LAT table again, and it appears to be right. And his address is definitely NOT in that table.

(in reply to kendal)

Post #: 4

RE: Wierd Person listed in sessions - 3.Jul.2002 8:41:00 PM

tshinder

Posts: 47669
Joined: 10.Jan.2001
From: Texas
Status: online

Hi Kendal,

How do you have your external interface connected? Are you allowing connections to the DSL hub for other computers? Only the ISA Server should be connected to the hub.

Thanks!

Tom

(in reply to kendal)

Post #: 5