topic system logs in General Topics https://live.paloaltonetworks.com/t5/general-topics/system-logs/m-p/25569#M18655 <HTML><HEAD></HEAD><BODY><P>Can anyone tell me what is going on in this log? It doesn't look like the RDC brute force attacks that i see all the time</P><P><IMG alt="PAN system log.jpg" class="jive-image-thumbnail jive-image" src="https://live.paloaltonetworks.com/legacyfs/online/3946_PAN system log.jpg" width="450" /></P></BODY></HTML> Tue, 04 Sep 2012 19:11:41 GMT Bagar390 2012-09-04T19:11:41Z system logs https://live.paloaltonetworks.com/t5/general-topics/system-logs/m-p/25569#M18655 <HTML><HEAD></HEAD><BODY><P>Can anyone tell me what is going on in this log? It doesn't look like the RDC brute force attacks that i see all the time</P><P><IMG alt="PAN system log.jpg" class="jive-image-thumbnail jive-image" src="https://live.paloaltonetworks.com/legacyfs/online/3946_PAN system log.jpg" width="450" /></P></BODY></HTML> Tue, 04 Sep 2012 19:11:41 GMT https://live.paloaltonetworks.com/t5/general-topics/system-logs/m-p/25569#M18655 Bagar390 2012-09-04T19:11:41Z Re: system logs https://live.paloaltonetworks.com/t5/general-topics/system-logs/m-p/25570#M18656 <HTML><HEAD></HEAD><BODY><P>Do you have a captive portal, GlobalProtect, or the WebUI on an external/WAN interface?</P><P></P><P>Someone is trying to login, but the name doesn't match any authentication profiles you have setup. Look like they are stationed in China. (<A href="http://www.robtex.com/ip/218.201.249.211.html#ip" title="http://www.robtex.com/ip/218.201.249.211.html#ip">218.201.249.211 - robtex</A>) </P><P></P><P>There should be brute force signature for the NetClient/GlobalProtect in the IPS.</P></BODY></HTML> Tue, 04 Sep 2012 20:34:16 GMT https://live.paloaltonetworks.com/t5/general-topics/system-logs/m-p/25570#M18656 mharding 2012-09-04T20:34:16Z Re: system logs https://live.paloaltonetworks.com/t5/general-topics/system-logs/m-p/25571#M18657 <HTML><HEAD></HEAD><BODY><P>Someone is attempting an attack to the firewall from the ip 218.201.249.211. You can block all the traffic to/from China (CN) or the particular ip.</P><P></P><P>This document explains the zone protection: <A __default_attr="3581" __jive_macro_name="document" class="jive_macro jive_macro_document" href="https://live.paloaltonetworks.com/"></A></P></BODY></HTML> Wed, 05 Sep 2012 21:29:07 GMT https://live.paloaltonetworks.com/t5/general-topics/system-logs/m-p/25571#M18657 zarina 2012-09-05T21:29:07Z