Networks

Ask something
Discussion Locked

fake ips on isa

0 helpful
4 replies

by elemzy

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

hello,
i think i am being spoofed. i can see fake ips on isa sessions and when i look at the isa log files. eg 61.152.102.44. which is different from my private ip (172.16.x.x). i have actually gotten report about these ips spamming some site. i have checked my isa ip for smtp relaying, and open proxy and its safe.
how can i block these ips. Note that my isa is behind a firewall and its is the only machine permitted to go out using NAT thru the firewall.

4 replies

by cg it

In referring to ISA do you mean Internet Security and Acceleration Server by Microsoft?

by ewgny

You can start by making an allow rule for the range of your private IP range to allow outbound
access only, instead of any IP to any IP
or you can require windows authentication for your outbound access which would prohibit anyone else from using ISA for http access. But your big problem is finding where the rogue user is within your internal network.

by elemzy

thats is what i have done initially, but what i what to know is the rogue ip.

This discussion is closed to new replies.