1

From my SIEM I am seeing that a (we don't own the FW) Cisco ASA is blocking packets destined for the internal network (post NAT), here's what I'm seeing (IP addresses are faked due to security)

170.100.1.1 External Host (A)

Firewall

192.168.1.1 Internal Host (A) | | 192.168.1.2 Internal Host (B) | | 192.168.1.3 Internal Host (C)

Example of the SIEM report/Firewall deny

"Deny udp src outside:170.100.1.1/3478 dst inside:(any of the internal hosts)/5219 by access-group "outside_access_in""

We're in a bit of a pickle due to us not owning the FW, nor are we able to see the logs, so I can't see the specific rule nor can I see the specific packets

How can the external source know the private address of the internal hosts if it hasn't already been in contact with the hosts i.e. why would the Firewall randomly block the packets?

The ports are completely random, all empheral and none within the assigned port ranges.

I need some help please!!!

Improve this question
2

The firewall isn't randomly denying the packets, and it is very unlikely that they are being dropped because of a bug. In all likelihood the packets are being dropped because that is what the policy says for the firewall to do. Port 3478 is STUN, a protocol used by UDP for NAT traversal. There are some possibilities:

  • The traffic is authentic, and the traffic back is being incorrectly blocked by firewall rules. In this case the FW admin would need to fix the rules blocking the traffic
  • The traffic is authentic, and being blocked for good reasons, in which case you need to do nothing
  • The traffic is an attack. It could be an external party attempting to access your internal network by using crafted STUN packets. In this case the firewall is working perfectly by blocking it and the SIEM working perfectly by notifying you of the attack, in which case be happy - that's why you buy an SIEM

Which of these it is depends on whether any of your systems has attempted to connect to external host A using STUN. It so happens that you, or someone you work with, has access to internal hosts A, B, and C. Ask them to check whether those systems are attempting to connect to external host A. It also is probable that your organization pays for an outsourcer to manage your firewalls, and if so call them up and discuss the entries with them.

Improve this answer
2
  • Brilliant answer! Something had gone wrong with the filters I was looking at & I didn't recognise that the port number was ONLY 3478 & 3479. I sorted the results properly and I only see the two port numbers 3478 and 3479. From reading, it seems STUN uses only 3478. I have to see why 3479 is being used too. I had another look at my SIEM and no traffic was detected to the external IP host as the destination. It's only the source of the network traffic, so it is looking like I have to get someone to look at the internal hosts – Mehcs85 Jan 17 '13 at 19:52
  • It may be stun, or it could be something else using those two ports. A packet capture on the internal hosts will tell you one way or another. – GdD Jan 18 '13 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.