Why differents interfaces in logs that concern to one rule?

LuisSP — Thu, 18 Oct 2018 17:03:29 GMT

Saludos.... we have a 1490 smb appliance as perimeter firewall. Two devices at LAN (192.168.3.8, 192.168.3.9) connect to a server (13.82.177.x). ...but I have doubts about logs:

even though each device connect to server more than once in a period of time, appliance only logs one time. I am sure that it makes more than one connection, because in each one,, an email is received, and I have the precaution of waiting to receive such email before "firing" another event that causes a connection
Why in the logs the interface WAN appears in one occasion and in another the LAN? randomly I do not think ... but I can not find the pattern !!

It is worth mentioning that the logs are saved in a sdcard memory inserted in the appliance, and recently had to be reinserted because the logs were not being saved.

Thanks!!

Re: Why differents interfaces in logs that concern to one rule?

PhoneBoy — Fri, 19 Oct 2018 16:36:49 GMT

What you're seeing in the logs are sessions, which correlate data across several connections.

As to why it's logging LAN versus WAN sometimes, it may be related to the first packet seen on session correlation, which is based on (in)activity.

topic Re: Why differents interfaces in logs that concern to one rule? in Firewall and Security Management

Why differents interfaces in logs that concern to one rule?

Re: Why differents interfaces in logs that concern to one rule?