PDA

View Full Version : Firewall Question


David McRell
04-18-2006, 02:35 PM
We use NAT for LAN clients, and the DigiDelivery appliance is on the DMZ interface along with our other public servers.

When a LAN client completes a DigiDelivery post, the connection closes, which seems normal. Immediately following that, however, the DD appliance attemps to connect from port 80 back to the client (via outbound NAT address) on a range of high ports (31751, 31689, 31745, 31743, 31747, 31741) but not the same port range as the client originally used to post. This triggers a port scan alert from my firewall.

Any information on this?

DigiTechSupt
04-25-2006, 09:31 AM
This doesn't really make sense, as the DigiDelivery hardware doesn't permit outbound connections on those ports. Are you absolutely sure that the scans aren't coming from elsewhere?