Strange log - Originating from against

[Arthur_DENIS1]

Hi,

I found a strange and recurring log "originating from against" for the blade IPS - see screenshot

No behavior, but a lot of this for all our firewall.

Firewall and MGMT are running version R80.20

Any idea for that point ?

Thanks,
Arthur

[G_W_Albrecht]

There is not much that can be said when the only detail we know here is the version 8)

[Arthur_DENIS1]

Indeed, but what I can says... 

We get this message from all firewall without an apparent reason.

Do you have already see this message ?

[G_W_Albrecht]

Look into the logs in SVTracker - look for logs from the same source at the same time...

[Arthur_DENIS1]

OK so I try to find the same log with SVTracker, but no way to find it.

Regarding the othe logs from the same origin, we have a lot of accept and Drop (about 1600 entry for the same second) - icmp/tcp/udp - but only from the firewall blade.

This is the only log from IPS blade at this exact time from this specific origin.

[PhoneBoy]

Might be worth a TAC case.

[FireMage]

hello,

was there a solution for this? i currently have the same behaviour with our r81.20.

thanks
jeff

[Timothy_Hall · Accepted solution]

This is related to the Log Suppression feature of Threat Prevention, which was covered by my 2022 CPX speech Max Gander: The Hidden World of Log Generation and Log Suppression at Check Point

Bottom line is that this is expected behavior, please see sk115876: Some fields are missing from IPS or Threat Prevention logs