topic Re: Ukraine IP address filling 75% of my VPN Logs in SASE and Remote Access

Ukraine IP address filling 75% of my VPN Logs

ICSI — Mon, 24 Jul 2023 05:34:19 GMT

When checking the logs of my Harmony Connect VPN service I can see that there is a couple of IPs address coming from Ukraine that are generating 75% of my logs.

Are you experiencing the same?

Last week I reported the same incident but from two different IPs as well from Ukraine and looks to me that the TAC people helped me out to block them. last IP: 109.207.200.44

If you check your Harmony Connect VPN logs, can you see them too?

I understand the part of: they do not have the keys, or certificate and etc to break in, yeah, but those IPS are saturating Check Point logs and probably even degrading the service.

Does anyone know how to block them with involving TAC? I already added a policy that blocks any access from those IPs and nothing actually happened because I think it only applies to the valid traffic inside the VPN.

An email was sent today to the organization in Ukraine that are in charge of those IPs. nothing might happen!

Thoughts?

Re: Ukraine IP address filling 75% of my VPN Logs

_Val_ — Mon, 24 Jul 2023 07:37:54 GMT

I would suggest using GEO policy to block the country, if you do not expect any connections coming from there.

Re: Ukraine IP address filling 75% of my VPN Logs

Lesley — Mon, 24 Jul 2023 08:53:05 GMT

Same, GEO protection and block the unwanted countries.

Here is the SK:

https://support.checkpoint.com/results/sk/sk126172

Re: Ukraine IP address filling 75% of my VPN Logs

PhoneBoy — Mon, 24 Jul 2023 13:02:23 GMT

This (before encryption) traffic is accepted through implied rules.
Short of changing the implied rules, the best way to block this traffic is using fwaccel dos rules: https://community.checkpoint.com/t5/Security-Gateways/Block-VPN-Traffic-by-Country/m-p/172695#M31396

Re: Ukraine IP address filling 75% of my VPN Logs

Andy_P — Tue, 25 Jul 2023 07:23:59 GMT

I believe this is a result of bots/vulnarebility_scaneers activities.

Based on topic you're using Harmony Connect Network Access client. Please raise ticket with TAC to block traffic from countries you don't want get traffic.