topic Re: unknown traffic from VPN blade in SASE and Remote Access

unknown traffic from VPN blade

Renjith_M_P — Mon, 03 Feb 2020 06:24:48 GMT

Hi All,

could you please explain why VPN is initiating traffic to an unknown destination.(SC attached)

Re: unknown traffic from VPN blade

G_W_Albrecht — Mon, 03 Feb 2020 08:19:32 GMT

This is a rather nice wish - but only you do know what is configured here ! The peer GW must be included in a VPN Community, otherwise, no key install will be sent. At least, this VPN is not coming up, so if you do not want it, you could even leave it this way 8)

Re: unknown traffic from VPN blade

Timothy_Hall — Mon, 03 Feb 2020 13:23:05 GMT

Based on the screenshot, your Check Point firewall is not the one initiating. Your firewall is sending a response to 164.52.x.x who attempted to start an IKE Phase 1 negotiation with you; the full content of the sent notification is not shown in your screenshot but it is probably "Invalid ID". This response is sent by a Check Point firewall when an unknown peer/IP address attempts to start a VPN negotiation; in a site to site setup VPN peer IP addresses must normally be known ahead of time.

Re: unknown traffic from VPN blade

Renjith_M_P — Tue, 04 Feb 2020 13:49:31 GMT

Hi @Timothy_Hall ,

yes, that is my doubt. a VPN traffic is initiated to check point from an unknown IP which is not configured in my device, traffic got rejected by the device but after that a response is sending as key install. details are in attached screen shot. what kind of behavior is this.

we are getting lot of request from this unknown IP to some of the internal IP's. service is IKE ( Screen shot attached). we don't have any DAIP for this setup. as a precautionary measure i have created an object and blocked this source IP in the policy.

is it a kind of attack. if yes how do i identity which device is originating this traffic and any helping hand from inside object.

Thank you for response.

Re: unknown traffic from VPN blade

Timothy_Hall — Sun, 09 Feb 2020 15:05:32 GMT

Your firewall is properly blocking it, there is nothing to be concerned about. The attacker isn't going to get anywhere.

You can see the owner of the netblock sending these IKE requests here:

https://wq.apnic.net/static/search.html?query=164.52.36.247

I suppose you could try contacting the abuse email for that netblock, but in my experience with the specific country involved here you are just wasting your time. It could also just be some kind of misconfiguration on their end but I highly doubt it.