malicious connections from the fortigate

Hi ,

Could you kindly elaborate on the issue?

1. where is discovered
2. Any FortiGate malicious detection
3. Any security profile applied to policy

Hi @unknown1020 

As I understand from your query, you are observing malicious traffic from Fortigate IP.

+ May I know where is the IP located in Fortigate Firewall?
+ Could you please share security event logs and forward traffic logs with respect to the Malicious IP?
+ Also, you may create Local in policies to block the malicious IP by following below doc. article.
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/363127/local-in-policies

Thanks,

@chauhans 

You may be hitting https://www.fortiguard.com/psirt/FG-IR-22-398 , can you check if you are seeing connections to below IPs?

Connections to suspicious IP addresses from the FortiGate:

188.34.130.40:444
103.131.189.143:30080,30081,30443,20443
193.36.119.61:8443,444
172.247.168.153:8033
139.180.184.197
66.42.91.32
158.247.221.101
107.148.27.117
139.180.128.142
155.138.224.122
185.174.136.20

More details on https://www.fortinet.com/blog/psirt-blogs/analysis-of-fg-ir-22-398-fortios-heap-based-buffer-overflow-in-sslvpnd