Tim Mullen came up with a good question the other day regarding directionality notations in his ISA Firewall’s log files. What appeared to be an inbound connection was logged as an outbound connection.

To clarify the situation, Jim Harrison came up with the following explanation, which indeed explains the situation very nicely:

===============================================

The traffic “direction” is determined by the rule.

What rule is quoted for the deny action?

If it’s the default rule, then that’s correct, because Access rules only deal in “outbound” traffic.

Since the “default deny rule” is an access rule, it deals only with “all outbound protocols”.

Here’s another conundrum to wrap up in your dilemma…

SvrPubRule

Primary Connection: TCP:666 Inbound

From: External

Access Rule

Primary Connection: TCP:666 Outbound

From External

To: Local Host

If the SPR is listed first, it will “fire” and the traffic will be listed as “inbound”

If the access rule is listed first, it will fire and the traffic will be listed as “outbound”.

===============================================

Thanks Jim!

HTH,

Tom

Thomas W Shinder, M.D.
Site: http://www.isaserver.org/
Blog: http://blogs.isaserver.org/shinder/
Book: http://tinyurl.com/3xqb7
Email: tshinder@isaserver.org
MVP — Microsoft Firewalls (ISA)