Global Protect Authentication Destination is 0.0.0.0

[Arunkumar27]

Hi,

I have a SIEM use case for VPN login failures followed by success to the same user after 5 failures.

When I check the event, I could see the source is external IP as expected and destination is 0.0.0.0 and with our internal VPN gateway IP alternatively.

Here I am getting confusion should I consider the destination IP 0.0.0.0 also or we can ignore it for failures.

Thanks

Reply

[Arunkumar27]

Hi,

I have a SIEM use case for VPN login failures followed by success to the same user after 5 failures.

When I check the event, I could see the source is external IP as expected and destination is 0.0.0.0 and with our internal VPN gateway IP alternatively.

Here I am getting confusion should I consider the destination IP 0.0.0.0 also or we can ignore it for failures.

Thanks

[reaper]

i'm not sure i'm visualizing your logs correctly, but i'm assuming the logs that contain 0.0.0.0 do not have a destination IP as they are system/auth logs indicating a failure rather than a connection

can you add (cleaned up) screenshots?