topic Re: Strange log - Originating from against in Firewall and Security Management

Strange log - Originating from against

Arthur_DENIS1 — Tue, 14 Jan 2020 13:14:09 GMT

Hi,

I found a strange and recurring log "originating from against" for the blade IPS - see screenshot

No behavior, but a lot of this for all our firewall.

Firewall and MGMT are running version R80.20

Any idea for that point ?

Thanks,
Arthur

Re: Strange log - Originating from against

G_W_Albrecht — Tue, 14 Jan 2020 13:23:45 GMT

There is not much that can be said when the only detail we know here is the version 8)

Re: Strange log - Originating from against

Arthur_DENIS1 — Tue, 14 Jan 2020 13:34:54 GMT

Indeed, but what I can says...

We get this message from all firewall without an apparent reason.

Do you have already see this message ?

Re: Strange log - Originating from against

G_W_Albrecht — Tue, 14 Jan 2020 13:37:27 GMT

Look into the logs in SVTracker - look for logs from the same source at the same time...

Re: Strange log - Originating from against

Arthur_DENIS1 — Tue, 14 Jan 2020 13:59:38 GMT

OK so I try to find the same log with SVTracker, but no way to find it.

Regarding the othe logs from the same origin, we have a lot of accept and Drop (about 1600 entry for the same second) - icmp/tcp/udp - but only from the firewall blade.

This is the only log from IPS blade at this exact time from this specific origin.

Re: Strange log - Originating from against

PhoneBoy — Fri, 17 Jan 2020 01:45:50 GMT

Might be worth a TAC case.

Re: Strange log - Originating from against

FireMage — Sun, 08 Sep 2024 17:03:03 GMT

hello,

was there a solution for this? i currently have the same behaviour with our r81.20.

thanks
jeff

Re: Strange log - Originating from against

Timothy_Hall — Mon, 09 Sep 2024 12:24:51 GMT

This is related to the Log Suppression feature of Threat Prevention, which was covered by my 2022 CPX speech Max Gander: The Hidden World of Log Generation and Log Suppression at Check Point

Bottom line is that this is expected behavior, please see sk115876: Some fields are missing from IPS or Threat Prevention logs