topic Strange IPs in the IKE_SA_table in General Topics

Strange IPs in the IKE_SA_table

Igor_Demchenko — Wed, 12 Jul 2023 12:55:56 GMT

Hi, All!

When i run fw tab -t IKE_SA_table -c -f on th CP cluster I get

Instead of my peer's IPs i see different unknown IPs.

I dont understand what are these IPs and where are they from.

vpn tu tlist shows correct addresses...

This cluster doesnt have permission to connect to the Internet (only to defined IPs)

We have the same situation on 81.20 and 80.40. And besides the 80.40 cluster doesnt have any permissions to the Internet at all.

Does anyone face with this issue?

Or may be this is the bug in the command ?

Re: Strange IPs in the IKE_SA_table

Tal_Paz-Fridman — Wed, 12 Jul 2023 13:15:17 GMT

Do you recognize any of the IPs?

Even if the Cluster or Gateway do not have permission to access other destinations the connection from the Cluster/Gateway can be allowed using Implied Rules. Perhaps try to enable logging of Implied Rule to see if it matches the connections.

Re: Strange IPs in the IKE_SA_table

Igor_Demchenko — Wed, 12 Jul 2023 13:28:51 GMT

No, I dont recognize any of these IPs. I know all my peers in my Star VPN community, but there are no these addresses

And i dont see any matches in logs.

And my second (80.40) cluster is on-premis and all connects are using private IPs.