Global Protect Authentication Destination is 0.0.0.0

Arunkumar27 — Fri, 08 Sep 2023 07:00:22 GMT

Hi,

I have a SIEM use case for VPN login failures followed by success to the same user after 5 failures.

When I check the event, I could see the source is external IP as expected and destination is 0.0.0.0 and with our internal VPN gateway IP alternatively.

Here I am getting confusion should I consider the destination IP 0.0.0.0 also or we can ignore it for failures.

Thanks

Re: Global Protect Authentication Destination is 0.0.0.0

reaper — Mon, 11 Sep 2023 10:58:02 GMT

i'm not sure i'm visualizing your logs correctly, but i'm assuming the logs that contain 0.0.0.0 do not have a destination IP as they are system/auth logs indicating a failure rather than a connection

can you add (cleaned up) screenshots?

topic Global Protect Authentication Destination is 0.0.0.0 in General Topics

Global Protect Authentication Destination is 0.0.0.0

Re: Global Protect Authentication Destination is 0.0.0.0