Failed Connection Attempts - OpenDNS

[gsarica]

Can anyone assist with this issue or have seen it before?

Basically we keep getting hundreds of blocked 'threats' in our logs from an unknown source to the OpenDNS server IP's:

We do use OpenDNS for filtering purposes as well and keep the DNS Filter off (for now anyway) on the FortiGate. Also, these entries only seem to be generated by devices connected to our wireless AP's and not by any PC's that route straight through the FortiGate.

[gsarica]

I think I might have answered my own question though I'm not 100% sure. I believe since we're using DNS filtering with OpenDNS and the AP's are acting as routers, they're sending traffic to OpenDNS and when it's denied there, the FortiGate is reading that as a failed connection attempt. The FortiGate has no way of telling that it was a failed connection because it was blocked by OpenDNS.