Strange log - Originating from against

[Arthur_DENIS1]

Hi,

I found a strange and recurring log "originating from against" for the blade IPS - see screenshot

No behavior, but a lot of this for all our firewall.

Firewall and MGMT are running version R80.20

Any idea for that point ?

Thanks,
Arthur

[G_W_Albrecht]

There is not much that can be said when the only detail we know here is the version 😎

[Arthur_DENIS1]

Indeed, but what I can says... 

We get this message from all firewall without an apparent reason.

Do you have already see this message ?

[G_W_Albrecht]

Look into the logs in SVTracker - look for logs from the same source at the same time...

[Arthur_DENIS1]

OK so I try to find the same log with SVTracker, but no way to find it.

Regarding the othe logs from the same origin, we have a lot of accept and Drop (about 1600 entry for the same second) - icmp/tcp/udp - but only from the firewall blade.

This is the only log from IPS blade at this exact time from this specific origin.

[PhoneBoy]

Might be worth a TAC case.