topic Re: Unknown Source and Unknown Destination IP address showing in monitor logs in Next-Generation Firewall Discussions

Unknown Source and Unknown Destination IP address showing in monitor logs

Sasikumari — Wed, 15 May 2024 09:30:37 GMT

Hello Team,

Good day to you !!

++We have one customer he facing issue with Unknown Source and Unknown Destination IP address showing in monitor logs.

++That Unknown Source IP address traffic is showing in monitor traffic logs with unknown destination IP address which does not belongs to your organization

++as we can see that there are multiple unknown source IP address traffic with unknown destination IP address traffic in monitor logs with different different country name

++most of the traffic are hitting to intrazone-default-rule.

Kindly help me to address the issue.

Regards

Sasikumari.

Re: Unknown Source and Unknown Destination IP address showing in monitor logs

jfernandez1 — Wed, 15 May 2024 21:39:05 GMT

It is really expected, since traffic coming from Internet to the public facing IP of the Firewall is traffic from untrust to untrust. It's advised to enable session logging on intrazone-zone and interzone policies only for troubleshooting reasons, since it might be filling your logs with information not really usefull.

In summary, it's the firewall doing its job 🙂

Re: Unknown Source and Unknown Destination IP address showing in monitor logs

Satyak — Sat, 18 May 2024 10:48:56 GMT

Hi @jfernandez1

Is it really expected behavior as the Public facing ISP IP is different from what it is showing in traffic logs.

Please find the attached screenshot for reference

We don't know the source and Destination IP's .

Thanks and Regards

Satya Kalyan

Re: Unknown Source and Unknown Destination IP address showing in monitor logs

jfernandez1 — Mon, 20 May 2024 13:18:03 GMT

Hello @Satyak

yes, internet connections are continuously scanned from external actors, this since attackers may be taking multiple IP prefixes to scan and check if there's a service opened they can exploit, here's the importance of using firewalls 🙂