topic Wildfire Alert reporting source and destination NATs that aren't configured on associated firewalls in General Topics

Wildfire Alert reporting source and destination NATs that aren't configured on associated firewalls

jstcolorado — Mon, 21 Nov 2016 23:03:24 GMT

Greetings,

We've had several Wildfire Alerts that show both the source and destination addresses translated yet NAT is not configured. For the subject data flow, the source is an external network for which we have no control. The destination is our client. The Alert shows that that the Source address is being translated to another address that is not under our control. The destination address is shown as being translated to our firewall's address. NAT is not configured for either situation in our PA firewalls. Any ideas?

Thanks!

Re: Wildfire Alert reporting source and destination NATs that aren't configured on associated firewa

santonic — Tue, 22 Nov 2016 07:04:11 GMT

Check the ports. TCP connection was probably in the other direction; from client to internet for which you have destination (hide) NAT. Like normal web browsing session goes.

Re: Wildfire Alert reporting source and destination NATs that aren't configured on associated firewa

jstcolorado — Tue, 22 Nov 2016 15:55:31 GMT

The flow started with out client connecting via TCP 80 to an external web server. The web server, in return, downloaded software to our client. This thread is focused on the server to client communication - Server [TCP-80] to client [61905].

The server IP is shown in the Wildfire Threat alert as being translated to another external IP. The client is being shown as being translated to our firewalls IP. What's interesting is that the client IP is also seen in PCAPs going to other Internet sites without address translation and we've verified that we have no firewall configurations to translate the client IP. The server IP was also seen in another Wildfire Threat Alert and the Alert specifies that it was translated to yet another address. Here are the threat alerts that show the server IP being tranlated to two different addresses. Note that I used ficticious addresses for the purpose of this exampbe

Threat Allert #1: medium: 1.1.1.1 ->2.2.2.2 Windows Executable

subtype: wildfire

category: malicious

direction: server-to-client

src: 1.1.1.1 (remote server)

dst: 2.2.2.2 (our client)

natsrc: 3.3.3.3 (??????)

natdst: 4.4.4.4 (Local PA firewall IP)

Threat Alert #2: medium: 1.1.1.1 -> 2.2.2.2 Windows Executable

subtype: wildfire

category: malicious

direction: server-to-client

src: 1.1.1.1 (same remote server)

dst: 2.2.2.2 (same client)

natsrc: 5.5.5.5 (server translated to a differnet IP this time)

natdst: 4.4.4.4 (Local PA firewall IP)