Possible attack on my SQL server? Checking my SQL Server log I see several entries like this:

Date: 08-11-2011 11:40:42
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:42
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.


Date: 08-11-2011 11:40:41
Source: Logon
Message: Login failed for user 'sa'. Reason: Password did not match for the login provided. [CLIENT: 56.60.156.50]
Date: 08-11-2011 11:40:41
Source: Logon
Message: Error: 18456. Severity: 14. State: 8.


And so on..
Is this a possible attack on my SQL Server from the Chinese???!
I looked up the IP address at ip-lookup.net which stated it was Chinese.

And what to do?


Block the IP adress in the firewall?
Delete the user sa?


And how do I protect my web server the best?!

Thanks in advance!
If you have a firewall, why is the database server exposed to the internet?


The firewall should block all access to BOTH servers apart from the ports required. Typically this would be 80 (http) and 443 (https) to the web server ONLY.
If (and only if) an external service requires access to the SQL Server, permit access to the specific IP addresses required at the firewall. This should occur via a VPN connection, not openly exposed 1433.
Create a new administrator account and disable the default 'sa'.
Preferably, switch from using "mixed mode" authentication to windows accounts.