HI.
How exactly did you run the test, and from where (directly in the outside network, or via the Internet and ISP)?
* I think that this is the "TCP intercept feature" of the pix.
I don't know why only ports 25 and 110 are affected (maybe the port scanner is more aggresive with these ports?).
For the test, you can change this:
> static (intf2,outside) xxxxxxxxxxxxx 192.168.4.10 netmask 255.255.255.255 1000 10
To this:
static (intf2,outside) xxxxxxxxxxxxx 192.168.4.10 netmask 255.255.255.255 0 0
and see if removing the connection limits changes the picture.
Then place again your initial static with the limits to protect your server, as this is probably what you wanted in the first place.
Read here:
Here is a quote from the above link:
=== Start quote ===
"
TCP Intercept Feature
Prior to version 5.3, PIX Firewall offered no mechanism to protect systems reachable via a static and TCP conduit from TCP SYN attacks. Previously, if an embryonic connection limit was configured in a static command statement, PIX Firewall simply dropped new connection attempts once the embryonic threshold was reached. Given this, a modest attack could stop an institution's Web traffic. For static command statements without an embryonic connection limit, PIX Firewall passes all traffic. If the affected system does not have TCP SYN attack protection, and most operating systems do not offer sufficient protection, then the affected system's embryonic connection table overloads and all traffic stops.
With the new TCP intercept feature, once the optional embryonic connection limit is reached, and until the embryonic connection count falls below this threshold, every SYN bound for the affected server is intercepted. For each SYN, PIX Firewall responds on behalf of the server with an empty SYN/ACK segment. PIX Firewall retains pertinent state information, drops the packet, and waits for the client's acknowledgement. If the ACK is received, then a copy of the client's SYN segment is sent to the server and the TCP three-way handshake is performed between PIX Firewall and the server. If and only if, this three-way handshake completes, may the connection resume as normal. If the client does not respond during any part of the connection phase, then PIX Firewall retransmits the necessary segment using exponential back-offs.
"
=== End quote ===
* Another option is that there is some kind of transparent mail filter at the ISP which intercepts that traffic.
Bye
Yizhar Hurwitz
