Unknown Source and Unknown Destination IP address showing in monitor logs

[Sasikumari]

Hello Team,

Good day to you !!

++We have one customer he facing issue with Unknown Source and Unknown Destination IP address showing in monitor logs.

++That Unknown Source IP address traffic is showing in monitor traffic logs with unknown destination IP address which does not belongs to your organization

++as we can see that there are multiple unknown source IP address traffic with unknown destination IP address traffic in monitor logs with different different country name 

++most of the traffic are hitting to intrazone-default-rule.

Kindly help me to address the issue.

Regards

Sasikumari.

[jfernandez1]

It is really expected, since traffic coming from Internet to the public facing IP of the Firewall is traffic from untrust to untrust. It's advised to enable session logging on intrazone-zone and interzone policies only for troubleshooting reasons, since it might be filling your logs with information not really usefull.

In summary, it's the firewall doing its job 🙂 

[Satyak]

Hi @jfernandez1 

Is it really expected behavior as the Public facing ISP IP is different from what it is showing in traffic logs.

 Please find the attached screenshot for reference 

We don't know the source and Destination IP's .

Thanks and Regards 

Satya Kalyan

[jfernandez1]

Hello @Satyak 

yes, internet connections are continuously scanned from external actors, this since attackers may be taking multiple IP prefixes to scan and check if there's a service opened they can exploit, here's the importance of using firewalls 🙂