topic Re: Single alert produces Session denied multiple DC servers LDAP 389 and why ? in GlobalProtect Discussions

Single alert produces Session denied multiple DC servers LDAP 389 and why ?

magendran.gopinathan — Fri, 01 Nov 2024 16:32:26 GMT

Hi,
Login Successful After Scan Attempt
I have a question regarding when user connecting VPN --which means session denied for multiple DC servers--Via global protect VPN.
SourceZone:GP-c
Type -TRAFFIC
Denied Port-389 which means LDAP.

Session End Reason-policy-deny
@everyone

once the user connected VPN with successful authentication Why scanning happening?

Re: Single alert produces Session denied multiple DC servers LDAP 389 and why ?

arusharma — Sat, 02 Nov 2024 05:51:32 GMT

What type of scan is happening?

Re: Single alert produces Session denied multiple DC servers LDAP 389 and why ?

magendran.gopinathan — Mon, 04 Nov 2024 21:35:48 GMT

We observed multiple DC servers from one SRC machine to Multiple DST DC servers IP are captured and for the port 137 & 389 all the sessions are denied when user facing VPN issues.