httpd event message creates HUGE logfiles

[MileAMinuteMarv]

I've just adopted a Raptor 6.5.0 firewall that generates the following event every .01 seconds or so

httpd Notice: The CONNECT method cannot be used to access port 2848 on the requested server due to the current firewall configuration.
This creates four log files daily of about 200 mb. The port number is nothing we knowingly use, and we don't know what to look at next. Any suggestions on what the problem is?
Thanks.

 

[intres]

Hello,

I have the same problem at the moment,have you already a solution for your problem?
if so, please let me know.

Thanks

 

[hungerf5]

My ISA server logs TCP traffic on 2848 to Symantec's Central Quarantine. My log files are growing just as fast as what's mentioned above.

I think on ISA I'll have to make a protocol definition for traffic on that port so it can get through. I found all this out by doing an NSLOOKUP on the destination IP in my logs.

I'll respond with my results. Hope this is of help...

--Rick

 

[intres]

I have used the program tcpdump what is on my firewall and find out that it is sure the problem comes from the Symantec's Central Quarantine server, its generating traffic to Symantec Security Response Team. You can find more about it in the knowledge base of symantec.
By default is use the ports 2847, 2848 but opening these ports from my server to symantec dont work at the moment.
I try now to find a way to solve the problem. if i find out a way i let you know

 

[intres]

The solution is to configure the HTTP service for the server to allow HTTP over SSL and create a port list where 2848 is in.

 

[MileAMinuteMarv]

I finally eliminated the messages.
Solution:
I created two protocols with reverse port groupings
tcpap-gsp2847, Protocol TCP, Destination Port Range 2847-2848, Source Port Range 1024-65535
tcpap-gsp2848, same except reverse port assignments
Set up Rule named Symantec Quarantine Access
connection coming in via ANY
From <server>
Destined for Universe
Coming out via ANY
Services are http* and the two rules above.
Highlight the http* service and select Configure
On the Http*, check allow HTTP
check Allow HTTP over valid SSL on the following ports:
Add ports 2847
2848
443
563
Click OK, then right click in the Rules right pane and select Save and Configure.
In the future I'll work with this to see if I can slim it down. I'll post any changes.