topic Threat logs source zone as Outside and Destination zone as Outside in firewall in Advanced Threat Prevention Discussions

Threat logs source zone as Outside and Destination zone as Outside in firewall

harishansal — Fri, 16 Jul 2021 18:09:04 GMT

Threat logs source zone as Outside and Destination zone as Outside in firewall

Re: Threat logs source zone as Outside and Destination zone as Outside in firewall

harishansal — Fri, 16 Jul 2021 18:09:52 GMT

Re: Threat logs source zone as Outside and Destination zone as Outside in firewall

yblancovar — Fri, 16 Jul 2021 18:40:15 GMT

That is completely expected. These are the threat logs written by the Zone Protection Profile (Reconnaisancde Protection) applied to the zone "Outside". The source (public IPs) running the SCAN is detected in the outside zone, and the destination IPs (probably the firewall's public IPs) are also assigned to the same zone. Source and destination IPs live in the same zone.