Dear All

 

On a regular basis I get the follwoing messages from ISA.

 

Subject: ISA Server alert: An intrusion was attempted by an external user.

Message Body: ISA Server name: WHATEVER

ISA Server detected an all port scan attack from Internet Protocol (IP) address xxx.xxx.xxx.xxx

 

There is an associated Event Log report

 

Event Type:      Warning
Event Source:      Microsoft Firewall
Event Category:      Packet filter
Event ID:      15105
Date:            21/10/2006
Time:            07:36:12
User:            N/A
Computer:      WHATEVER
Description: ISA Server detected an all port scan attack from Internet Protocol (IP) address xxx.xxx.xxx.xxx.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

I get these regularly. They are from a small group of IP addresses and I am happy that it is not an actual attack.

I get the following each time my children log into Club Penguin (www.clubpenguin.com)

 

ISA Server detected an all port scan attack from Internet Protocol (IP) address 209.213.108.135.

 

This will also occur during the time they are playing. The IP address is registered in DNS as belonging to club penguin. I have also received a similar "attack" when they have played a certain game in Neopets and I have received it once when I did something with my online banker.

 

Each time a DNS lookup on the IP address has provided me with enough assurance that I am not being attacked.

 

I believe it has something to do with the sites attempting to find a free port to set up a connection to play the game or allow my connectivity to the site application. I also believe it is to do with the java apps they are using.

 

What I would like to know is how I tell ISA that if an intrusion "all port scan" is detected from certain IP addresses, then do not report. I do not want to turn off Intrusion Detection just to stop getting these false positives by email.

 

I have looked at the General config under Configuration, but here all I can do is turn off specific attack types.

 

I have looked at the alert definitions in Monitoring, but they allow me to set up the alerts should the event happen but not filter which IP addresses are allowed to "scan" me.

 

Is there a policy I can create that will let these selected IP addresses connect to my internal clients without causing a false positive??

No and I wouldn't turn off the intrustion detection just to eliminate false positives.

 

Not sure what to add to that. Here's the explanation for why some sites throw false positives.

 

You can't specify which sites are false positives and which are not. Might be nice feature request though. You should send it to microsoft wish. http://support.microsoft.com/?kbid=114491  Note: I just checked the kb has gone missing. I'll let you know if I discover where it went. Meanwhile it might reappear.