ISA570 DNS internal blocking

Similar Questions

• DNS traffic blocked after PAT - PIX 515

  I have PIX 515 with 3 named NIC (internal, external, dmz)

  I have 2 servers (Exchange and Windows 2000 with SMTP) in the demilitarized zone.

  I currently have a static command pointing to doamin for exchange Server IP address in the DMZ.

  I wanted to PAT on the IP address of the e-mail domain so that the configuration will look like as follows.

  The IP field will be used for the global IP

  all pop3 for global ip traffic will go to Exchange

  all www for the global IP traffic will go to Exchange

  all smtp for global ip traffic will go to the Windows 2000-based SMTP relay (SMTP relay is configured to send the e-mail received in exchange Server)

  I hosted DNS udp and tcp traffic to the servers.

  before pat, the server can use DNS to resolve IP domain e-mail and send mail to the Internet.

  As soon as I PAT the Internet e-mail delivery stops.

  When I did an NSLOOKUP command returns an error indicating that the DNS server cannot be resloved.

  The servere DNS used by these 2 servers are servers DNS of ISP.

  Is there any concern when you PAT.

  Thank you

  Hello

  I found the problem:

  for now, your dmz servers can go to the internet with pop3, smtp, and www. Only for these protocols is a (static) translation to provide in the config file.

  You will need to will provide you a translation for other protocols (for example, dns) also. This can be accomplished with one of the following two things:

  create a nat - pair overall for the DMZ for outdoor

  NAT (dmz) 1 0.0.0.0 0.0.0.0

  Global (outside) 1 200.100.100.168 (already exists)

  create a static translation for each of the other protocols (next to pop3, smtp, www), you want to pass from the dmz to the internet (you already did that for www, pop3 and smtp).

  Kind regards

  Tom

• COR - internal block calls on CME

  Hi expert...

  is anyway to block internal calls on the CMF?

  for example, the extensions RouterA 1000,1001 and RouterB 2000,2001 extensions... I want to limit to 1000 will not be able to call 2000, but 1000 can call 2001

  I tried to configure as below, however, I still can call 2000 1000

  RouterA

  Dial-peer cor custom
  name 2000

  Dial-peer call list call2000
  Member 2000

  Dial-peer voice 2000 voip
  corlist outgoing call2000
  destination-model 2000
  session target ipv4:10.0.0.2
  Codec g711ulaw

  Dial-peer voice voip 2001
  destination-model 2000
  session target ipv4:10.0.0.2
  Codec g711ulaw

  ePhone-dn 1
  number 1000

  ePhone-dn 2
  number 1001
  corlist incoming call2000

  Thanks in advance

  Hey Torrence,

  List HORN to work, you must have corlist and out of dialpeers.

  Now, since ephone-dn 1 (for ext 1000) does not have a list Horn, it can make all the other dial-peers

  Correct configuration will be like this

  Dial-peer cor custom

  name of block-pt

  name license-pt

  Dial-peer cor list block2000

  Members block-pt

  Dial-peer cor list permit2000

  Members permit-pt

  Dial-peer voice 2000 voip
  corlist outgoing permit2000
  destination-model 2000
  session target ipv4:10.0.0.2
  Codec g711ulaw

  Dial-peer voice voip 2001
  destination-model 2000
  session target ipv4:10.0.0.2
  Codec g711ulaw

  ePhone-dn 1
  number 1000

  corlist incoming block2000

  ePhone-dn 2
  number 1001

  with this configuration, when 1000 dials 2000, router will check incoming cor block2000 list with outgoing cor permit2000 from the list. As incoming is not subnet of outgoing call fails.

  When 1000 2001 dials. The dial-peer courses has no cor list. So, no restrictions.

  for 1001, none entering cor list, so outgoing cor list does not apply

  Hope this helps

  Thank you

  Abu-

• Internal block operations on the client initialization master

  Hello.
  I composed of the captain and customer of replication group.
  When the client is running internal initialization, all operations to master are blocked for what period.
  Is this normal?
  Is possible to avoid this deadlock?
  I am using BDB 5.0.21 + Java API

  Because an ACK is a promise that the client has received the
  transaction, he wrote to his copy of the newspaper and applied the
  changes to its copy of the database. During internal initialization of the client
  is not an intact game log files and files of database pages, so it
  cannot write and apply new transactions.

  In the default configuration, the master not wait longer than 1 second
  for customer receipts, and so its progress would be completely blocked.

  In a typical deployment scenario, there are at least two clients. If
  a customer is in internal init, the other client can provide an acknowledgment,
  and that's enough to meet the master (at least under the default
  Ack QUORUM policy).

  Alan Bram
  Oracle

• DNS

  Hello!

  Allows DNS with HTTP and HTTPS rule better for performance of resolution for users who access the internet through sonicwall or let the internal DNS server the external resolution is preferable?

  Thank you.

  Hello

  It would be better to make your DNS internal resolutions. This is because internal this DNS server will be able to cache the search for data and make faster future research because it is already in its cache local to share with the rest of the devices in the network.

  Thank you
  Ben D.
  #Iwork4Dell

• Can add more than 2 DNS setting DHCP PIX 501?

  I would ask that can add more than 2 DNS DHCP PIX 501 framework? If so, how? I need to add two external DNS and DNS internal to my DHCP clients.

  Thanks for help.

  PIX only supports 2 DNS and WINS for dhcp clients

  I hope that helps... Rate if he does!

• How FF4 to use Google I'm feeling lucky feature?

  First of all, I thought it was something in the DNS, but again, this isn't a problem in FF3.6.13

  My web browsing workflow has been as follows-Type Web site name in the address bar, press on enter, wait for the mozilla.org home page to load.

  Now, if I do exactly the same thing in FF4b12, I get a page of google search results instead of the mozilla.org homepage.

  Why is this? And where in all: config I can fix that?

  I tried this on two different internet connections, my house using the ISP DNS ISP provided and on my place of work where we are facing a server DNS internal.

  I'm on a Mac running Snow Leopard 10.6.6 I use AdblockPlus and FirefoxB persona.

  See differences in query google below-
  FF4b10/11 used and it works the same in FF3.6

  http://www.Google.com/search?ie=UTF-8 & oe = UTF-8 & SourceId = navclient & gfns = 1 & q = Mozilla

  This is the query in FF4 b12-
  http://www.Google.com/search?q=Mozilla & ie = UTF-8 & oe = UTF-8 & aq = t & rls = org.mozilla: en - org.mozilla & client = firefox-a

  Do you see the difference?

  Firefox 3.6. * Search uses 'Browse by name' rather than "I m feeling lucky" Google
  To configure Firefox 4 to use the browse search names, you must change a hidden preference.

  1. Type of topic: config in the address bar and press on enter
  2. Accept the warning message that appears, you will be taken to a list of preferences
  3. Locate the preference keyword. URL, double-click it and replace it with the link below

  http://www.Google.com/search?ie=UTF-8 & oe = UTF - 8 & SourceId = navclient & gfns = 1 & q =

  If you want to use the I'm feeling lucky search, set it on this link:

  http://www.Google.com/search?btnI=I%27m+feeling+lucky & ie = UTF-8 & oe = UTF-8 & q =

• Airport Utility iOS advanced options disappear

  This morning, I noticed that my AU on iOS has none of the advanced options. The option restart also disappeared. There are two changes that have taken place:

  1) instituted by domain controller of origin with AD, DNS, and DHCP. Always had advanced options immediately after and was able to restart remotely HQ Airport Extreme.

  (2) upgraded to iOS 9.2. Did not consider new utility until AFTER the update.

  Basically everything I have now is the following:

  Base station > name and password

  Network > wifi ssid and password

  network invited

  Internet connection > ip and dns settings

  all other parameters have completely disappeared on ipad and iphone. Note that are present on mac os x (10.11.2) and have not changed. All others this experience or comments?

  The answer came. It's a bit delayed by protesting, but apparently if you provide a domain, DHCP and DNS internal controller, these options are not available. As soon as I stop the server, default DNS settings my ISP and open the DHCP range, everything is back. Pain during the execution of some servers, but at least I know now.

• Can damage the batteries or AC cause overheating?

  I just cleaned my vents and fan and I still think that the laptop (Pavilion dv7 4000 series) is warm. When it works on battery it 75 - ish and when I plug the AC it get 85 + degrees. Is it possible that a damaged batters or AC adapter / CC causes much more heat? If this is not the case, what would it be?

  If the laptop stops due to overheating, then yes it probably requires a repair. They would usually check the thermal paste/pad and fan to make sure it's working properly and that there is no internal blocking.

  You could try a cooling block to see if this will help to keep your laptop cool enough to exploit.

  You can also read through this to see if there's something more you can do: http://support.hp.com/us-en/document/c01657439

• Firewall of hollow for Wi - Fi reviews

  Hi guys. I like this diagram and users comments should be able to go to some of the internal servers such as email, etc.

  

  1 the questions is - guest users get to Server (which is in the internal network) only via external interface by e-mail?

  right now I open specific ports and ip for access, but some tests of penetration of security examiners don't like it and asked to leave comments access only hollow outside... which I can't does cause a ip DNS internal guest users and if I change my ip external dns they come out hollow, even outside the int and cannot return to the same internal network when I outside inside rules NAT. Why, I don't know...

  2. why configured comments wirelss (with external dns ip) user cannot return hollow apart from int to the internal? How can I solve this problem?

  Sorry, my friends, I have noticed today for destination NAT I always interface without comment thread on the inside (where are my servers) directly and translated into comments ip inside ip - that don't re - not solves application security penetration test.

  For the DNS doctor option - if I do nslookup/ping to my webmail address its response with its own internal ip that is not good.  Is it possible to fix it?

  Will be ASA dns doctoring work?

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

  I must admit that I am bit confused in #1 with your pen testers...  They think it's ok for people on the outside to access the application, but the people in the comments of wifi are not ok?

• Attempt of outgoing connection of MALWARE-CNC Win.Trojan.Pmabot etc...

  From time to time I get alerts such as the one above, there are others. These Holy typiically on a guest Wifi network I run.

  In my ACP (Position 3), I have an input allowing the application of DNS of my DMZ (area Wifi comments) outside my ASA. Other rules below match policy HTTP/HTTPS, etc. The default rule (last position) in countries ACP is a IPS active file policy, defined on allow traffic.

  I activated the config of the global block list in the settings of the CPA under the tab Security Intelligence & I changed DNS setting to include a blacklist of sites DNS that Taos record as a suspect.

  To block the DNS entries that precedes, it is just a case of removing the request for DNS entry (Position 3) in ACP countries and change my default rule (last place) permit on refuse to ensure that DNS traffic is blocked suspected sites. Or by doing this, I am in danger of blocking other types of traffic.

  I just want to allow HTTP, this HTTPS and DNS traffic, but with the latter to the destinations of confidence. During the research that trigger alerts above and others, I want to drop these if the DNS is blocked.

  Concerning

  Darren

  Hello team,

  First of all, make sure that you are in the latest version of the SRU in the device.

  By chance you run PHPMyAdmin in the device? Also check what are the variables for the HOME_NET and EXTERNAL_NET variables?

  If you think about it as a false positive alert, then provide as a result of the TACs in order to check if it is a false positive or an alert valid due to a problem.

  1 package corresponding to the rule:

  -Connect to the Web from DC interface

  -Go to "Analysis" > "Intrusions" > "Events" > Change Workflow for 'Table View of Events' > select the corresponding alert > click on 'download package '.

  -You should get a ZIP file that contains a capture of packets in PCAP format.

  -Send the ZIP file to TAC team and request an analysis.

  Note If the post will help you

  Concerning

  Jetsy

• VCSE and SRV records

  Hello world

  I have a general question about the SRV records and just need a bit of clarification. I have a client who has registered a domain for their express VCS, (tp.example.com). When I do a dns lookup it brings back the correct public ip address of the vcse. Now, I'll be confuring this system few however I don't know anything about SRV records.

  What I should allow the client to pass the SRV records relevant to their ISP for their external dns host?

  The public domain of customers is also identical to their internal domain. Im guessing the correct SRV records must be added to their server DNS internal too?

  Thanks for your help

  PS Si there is a good guide on adding files, srv etc then ide grateful if you could send me the link. Thanks again

  As we do not know your deployment it's hard to say, as if you have a cluster internally

  you use SRV records to sign up customers to allow failover. But who would most likely be

  some additional DNS entries and not necessarily the same as outside.

  If the systems are registered in their own country, they can work very well with no SRV record for the video domain.

  For external connectivity SRV records are more important.

  If you have a provider maintains the entries external DNS is the question put in place

  the SRV records.

  Please remember useful frequency responses and identify useful or correct answers.

• Exception no caughet as expected!

  Hi all
  Thanks for the reply.
  
  My DB version is:
  Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod
  PL/SQL Release 10.2.0.1.0 - Production
  
  I have following block and a nested block, to my surprise, the exception that is thrown in the INTERNAL block was not managed in the section except for the outer block, but in the external block of other section:
  
  declare
  an exception;
  Start
  
  declare
  an exception;
  Start
  raise one;
  end;
  
  exception
  When a time
  dbms_output.put_line (' ' a relief took outside ');
  while others then
  dbms_output.put_line ('OTHERS captured in a relief');
  end;
  
  Output is a relief in OTHERS->
  
  
  But when I executed suite to block, output was different, he was taken in the "expected Section", not in others this time:
  
  declare
  an exception;
  Start
  declare
  an exception;
  Start
  raise the no_data_found;
  end;
  exception
  When no_data_found then
  dbms_output.put_line ('exception raised in external "");
  while others then
  dbms_output.put_line ('OTHERS captured in a relief');
  end;
  
  output is-> exception raised in outside
  
  Can you please tell me if I'm missing something here?
  Thank you.

  In your first PL/SQL program, two defined exceptions are different. (even if the two are named 'a')

  Then of course since the outer block does not know your exception 'a' defined in the internal block, he will deal with this exception as 'OTHER '.

  To better understand run the code below

  SQL> declare
    2      a exception;
    3  begin
    4      --declare
    5          --a exception;
    6      begin
    7          raise a;
    8      end;
    9  exception
   10      when a then
   11          dbms_output.put_line('a raised caught in outer');
   12      when others then
   13          dbms_output.put_line('a raised caught in OTHERS');
   14  end;
   15  /
  a raised caught in outer
  
  PL/SQL procedure successfully completed.
  

  Now, if you do, both domestic and foreign exceptions, you will get the EXPECTED results.

  SQL> declare
    2      --Pointing "a" to a particular exception
    3      a exception;
    4      pragma exception_init(a,-60);
    5  begin
    6      declare
    7          a exception;
    8     --Pointing "a" same as in outer block
    9          pragma exception_init(a,-60);
   10      begin
   11          raise a;
   12      end;
   13  exception
   14      when a then
   15          dbms_output.put_line('a raised caught in outer');
   16      when others then
   17          dbms_output.put_line('a raised caught in OTHERS');
   18  end;
   19  /
  a raised caught in outer
  
  PL/SQL procedure successfully completed.
  

  Published by: JAC on June 23, 2012 15:36

• Links in wrong if access to the hive by instance of DMZ bcentral

  If I access bcentral hive on the DMZ server Webmail, TeamCollab, conference and Bcentral itself links are wrong.
  My DMZ Instance called beedmz.mydomain.com, ist
  My hive Instance is called beehive.intra.mydomain.com.
  
  The links displayed in bcentral are always http://beehive.intra.mydomain.com/..., no matter if I have access to hive through DMZ or locally.
  Of course if I have Beehive on DMZ I can fix the URL manually (and it will work then), but it's a bit uncomfortable.
  
  Any ideas what could be the problem?
  
  Thank you
  Jochen

  Hello

  merlin2 wrote:
  "There is only 1 virtual name in your instance... "does that mean we can mention does not exceed 1 virtual for an App Instance hive?

  It's true - in fact, it may be that a single virtualname hive all instances app and dmz.

  I configured two different names:
  -My App Instance internal booty is called beehive.intra.mydomain.com. This name is resolved internally of our DNS internal. This instance is configured without https and internal users work with this instance without problem.
  -My Instance of DMZ external hive is called beedmz.mydomain.com. This name is a name Internet official and resolved through the internet public DNS servers. It is not resolved by our internal DNS (why should he, it is only for external access).

  Internal users cannot connect to the Instance of the DMZ through the firewall. External users can connect to the instance of the DMZ, the affected ports are open, everything works perfectly (zimbra, teamcollab, o, OBEO,...).
  But I have to change the settings profile for external for o and OBEO users, http to https and beehive.intra.mydomain.com to beedmz.mydomain.com.

  Yes, as far as I've heard so far (I could only collect small pieces of information the last few days, I have not found a clear documentation how configure the DMZ Forum, where this simple real scenario is described) I would need a second VIRTUAL server entry in the configuration.
  But, if I understand you right, it is not possible.

  It's true. All users must use the same name for the hive servers, regardless of the question of whether they come from the internet or intranet. In the contrary case, it send links in notifications etc. impossible to treat (as hive do not know where the link has been received).

  What would be the correct way to configure this?
  My guess:
  The App Instance of hive and the Instance of DMZ Beehive must have the same DNS name.
  I need to make an entry in our internal DNS server that resolves the IP address of beehive.intra.mydomain.com to users internal beedmz.mydomain.com.
  I have to configure the VIRTUAL server to the name of beedmz.mydomain.com.
  Then internal and external users will have access to the same name, but with different IP addresses in the background.
  Am I right so far?

  That's exactly right. It is sometimes called "split DNS" where you have a dns server for internet customers (as beehive.yourdomain.com resolves to the dmz host) and another dns server for intranet clients (as beehive.yourdomain.com resolves to the hosts on the intranet).
  Alternatively, you could send your intranet clients via a virtual local network via servers in the dmz so not only the virtualhostname is the same, but the actual road and servers used by all clients is the same. It's a choice of network for you if.

  A few questions:
  How should I put HttpSslEnabled in the configuration of the VIRTUAL Server? true or false?

  Who controls if you want your users to use HTTPS or not for all their business on the web. What he in fact that all URLS generated by hive for customers have started to https://.
  Of course, you will need to follow the installation guide and make sure that you have the certificates etc. for your virtualhostname.

  If I set to true then beekeeper will work any more in this instance (I found an entry in metalink sure this will be fixed in 2.1).

  No, it's not good. The question of what you're probably thinking refers to activation of ssl from the ONS, which is an internal protocol used within the hive between servers (not for the hive web browsers).

  And every default internal customer will complain of the self-signed certificate so that I have to change each o/OBEO and customer conference for use HTTP, not https.

  Right - if you need a real certificate. Self-signed coming out of the box is just to facilitate the actual SSL configuration; you need a real SSL certificate of your favorite (as Verisign etc.) SSL cert provider

  But if I set it false then the configuration for external access to o/OBEO and the Conference is by default via http, not https.
  I could change that of course, but what I can't change are the settings for my windows mobile client (another my friends questions in this forum). So, it won't work.

  And therefore, if I want to add an additional Instance of DMZ Beehive (which must have another official DNS entry), that I need to set up an App Instance additional hive for this one?

  If you add another instance of hive DMZ, then you will need a router for load balancing. Your dns server will point to the loadbalancer IP address beehive.yourdomain.com, your host name of the virtual server is set to this value (NOT the value of a physical host in the dmz or intranet instances names) and your certificate will, of course, correspond to beehive.yourdomain.com.
  You can choose to terminate SSL at the loadbalancer or dmz hive bodies - but that is more detailed that I discuss here right now.

  Kind regards
  Richard

• IPS (7.0 (7) E4) on ASA-SSM-10 block DNS without alerts

  Hi all

  I have the IPS module:

  Build version: 1.1 - 7, 0000 E4

  ASA 5500 Series Security Services Module-10

  Update of the signature S652.0 2012-06-20

  Journal of the ASDM inferred events:

  4 June 26, 2012 18:21:47 193.227.240.38 53 IPS 65347 sd-out asked to drop the UDP packet from outside:193.227.240.38/53 to dmz1:sd - outside/65347

  But the IPS not deducted from alerts - it does not explain why blocking these packets. DNS requests cannot just one network.

  ! ------------------------------
  ! Current configuration last modified Tue Jun 26 18:01:58 2012
  ! ------------------------------
  ! Version 7.0(7)
  ! Host:
  !     Realm Keys          key1.0
  ! Signature Definition:
  !     Signature Update    S652.0   2012-06-20
  ! ------------------------------
  service interface
  exit
  ! ------------------------------
  service authentication
  exit
  ! ------------------------------
  service event-action-rules rules0
  filters edit PROXY
  attacker-address-range 192.168.72.7
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters edit Q00000
  signature-id-range 5684
  attacker-address-range 95.190.8.0-95.190.8.255
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters edit Q00001
  signature-id-range 5684
  victim-address-range 95.190.8.0-95.190.8.255
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters edit USERS
  signature-id-range 1102,5237,2152,5684,2100,5581,3030,6061,3030,11020,5403,5474,20020,60000-60100
  attacker-address-range 192.168.0.0-192.168.255.255
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters edit USERS2
  signature-id-range 5575-5591,2151,21619,2150-2151
  attacker-address-range 192.168.0.0-192.168.255.255
  victim-address-range 192.168.0.0-192.168.255.255
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters move PROXY begin
  filters move USERS after PROXY
  filters move Q00000 after USERS
  filters move Q00001 after Q00000
  filters move USERS2 after Q00001
  general
  global-deny-timeout 14400
  exit
  target-value low target-address 192.168.0.0-192.168.255.255
  target-value medium target-address 192.168.1.0-192.168.1.255,192.168.64.0-192.168.64.255,192.168.3.0-192.168.3.49,192.168.65.128-192.168.65.255
  target-value high target-address 192.168.72.2-192.168.72.254,192.168.66.0-192.168.67.255,192.168.2.0-192.168.2.255
  target-value mission-critical target-address 192.168.65.0-192.168.65.127
  os-identification
  calc-arr-for-ip-range 192.168.0.0-192.168.255.255
  exit
  exit
  ! ------------------------------
  service host
  network-settings
  host-ip 192.168.64.194/24,192.168.64.1
  host-name gw1-ips
  telnet-option disabled
  access-list 192.168.0.0/16
  dns-primary-server enabled
  address 192.168.66.2
  exit
  dns-secondary-server enabled
  address 192.168.72.19
  exit
  dns-tertiary-server enabled
  address 192.168.72.20
  exit
  exit
  time-zone-settings
  offset 360
  standard-time-zone-name GMT+06:00
  exit
  ntp-option enabled-ntp-unauthenticated
  ntp-server 192.168.64.1
  exit
  summertime-option disabled
  auto-upgrade
  cisco-server enabled
  schedule-option calendar-schedule
  times-of-day 04:20:00
  days-of-week sunday
  days-of-week tuesday
  days-of-week thursday
  days-of-week saturday
  exit
  user-name dimaonline
  cisco-url https://198.133.219.25/cgi-bin/front.x/ida/locator/locator.pl
  exit
  exit
  exit
  ! ------------------------------
  service logger
  exit
  ! ------------------------------
  service network-access
  general
  enable-acl-logging true
  never-block-networks 192.168.0.0/16
  exit
  exit
  ! ------------------------------
  service signature-definition sig0
  signatures 60000 0
  alert-severity low
  sig-fidelity-rating 50
  sig-description
  sig-name XPress Administrator Service
  sig-string-info Access to Administrator Service
  sig-comment External user open Admin
  sig-creation-date 20120622
  exit
  engine service-http
  max-field-sizes
  specify-max-uri-field-length no
  exit
  regex
  specify-uri-regex yes
  uri-regex [Aa]dministrator[Ss]ervice[.]asmx
  exit
  exit
  service-ports 80
  exit
  event-counter
  event-count 1
  event-count-key Axxx
  specify-alert-interval no
  exit
  alert-frequency
  summary-mode summarize
  summary-interval 15
  summary-key Axxx
  specify-global-summary-threshold no
  exit
  exit
  vulnerable-os windows-nt-2k-xp
  specify-mars-category yes
  mars-category Info/Misc/Login
  exit
  exit
  signatures 60000 1
  alert-severity low
  sig-fidelity-rating 50
  sig-description
  sig-name Xpress Bridge
  sig-string-info Service URL
  sig-comment External Access to bridge
  sig-creation-date 20120625
  exit
  engine service-http
  regex
  specify-uri-regex yes
  uri-regex [Bb]ridge[/][Ss]ervice[.]asmx
  exit
  exit
  service-ports 80
  exit
  event-counter
  event-count 1
  event-count-key Axxx
  specify-alert-interval no
  exit
  alert-frequency
  summary-mode summarize
  summary-interval 15
  summary-key Axxx
  specify-global-summary-threshold no
  exit
  exit
  status
  enabled true
  exit
  specify-mars-category yes
  mars-category Info/Misc/Login
  exit
  exit
  signatures 60001 0
  alert-severity high
  sig-fidelity-rating 90
  sig-description
  sig-name FreePBX Display Extentions
  sig-string-info Acces to Extentions settings
  sig-comment Weak Password Detection
  sig-creation-date 20120622
  exit
  engine service-http
  event-action produce-alert|deny-attacker-inline
  regex
  specify-uri-regex yes
  uri-regex [/]admin[/]config[.]php
  exit
  specify-arg-name-regex yes
  arg-name-regex display
  specify-arg-value-regex yes
  arg-value-regex (extensions)|(trunks)
  exit
  exit
  exit
  service-ports 80
  exit
  event-counter
  event-count 1
  event-count-key Axxx
  specify-alert-interval no
  exit
  alert-frequency
  summary-mode summarize
  summary-interval 15
  summary-key Axxx
  specify-global-summary-threshold no
  exit
  exit
  exit
  exit
  ! ------------------------------
  service ssh-known-hosts
  exit
  ! ------------------------------
  service trusted-certificates
  exit
  ! ------------------------------
  service web-server
  enable-tls false
  port 80
  exit
  ! ------------------------------
  service anomaly-detection ad0
  internal-zone
  enabled true
  ip-address-range 192.168.0.0-192.168.255.255
  tcp
  enabled true
  exit
  udp
  enabled true
  exit
  other
  enabled true
  exit
  exit
  illegal-zone
  enabled false
  tcp
  enabled false
  exit
  udp
  enabled false
  exit
  other
  enabled false
  exit
  exit
  ignore
  source-ip-address-range 192.168.0.0-192.168.255.255
  exit
  exit
  ! ------------------------------
  service external-product-interface
  exit
  ! ------------------------------
  service health-monitor
  signature-update-policy
  enable false
  exit
  license-expiration-policy
  enable false
  exit
  event-retrieval-policy
  enable false
  exit
  exit
  ! ------------------------------
  service global-correlation
  exit
  ! ------------------------------
  service aaa
  exit
  ! ------------------------------
  service analysis-engine
  virtual-sensor vs0
  physical-interface GigabitEthernet0/1
  exit
  exit
  

  I confirmed with the Ironport team that this IP is a bad host in sensorbase. This is the reason for the traffic of this host being removed. There could be several reasons for this subnet to the list, for example, it could be part of a controlled host known by spammers. You must reach out to the development team for a confirmation however.