Unknown remote IP negotiations error

Question

Hisince I turn on mail notification on VPN event I'm getting the error allotMY_IP is always my WAN1 IPUNKNOW_IP is diffrent vevrytime, when i get this error repeatedly the IP is all at the same subnet (only last number change)---------Message meets Alert condition date=2018-11-08 time=05:31:26 devname=FG100D devid=FG100D logid=0101037128type=event subtype=vpn level=error vd=root logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action=negotiate remip=UNKNOW_IP locip=MY_WAN_IP remport=20550 locport=500 outintf="wan1" cookies="3e35c70729dfedef/0000000000000000" user="N/A" group="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status=failure init=remote mode=main dir=inbound stage=1 role=responder result=ERROR  -------what this massage indicate? is it attack on my WAN?what can i do to prevent this error

m0j0 · Answer

Well, it could be someone trying to brute force their way into your network. If you only have site-to-site tunnels configured then you really don't have anything to worry about. If you have client IPSec configured then there is a very small chance they could eventually get in (very small).

If it's definitely always the same remote subnet and you have client IPSec configured, you could always put a block rule for that subnet above your IPSec policies. Or, put a blackhole route for that subnet in your static route table. Or, if you have a router outside your firewall that you have control of, put the blackhole route there.

Mark

Sign up

Login with SSO

Login to the community

Login with SSO