Is this normal behavior?

[Wilnel]

our antivirus guy will send me alerts from symantec. sometimes it gets these hits

[Somebody is scanning your computer. Your computer's TCP ports: 10000, 8910, 70, 32774 and 59906 have been scanned from xxx.xx.1.2.]   xxx.xx.1.2 is the firewall. If i put the host ip that is affected in the forwarded traffic in fortiview I do not see the event listed at the time. is this just some wild traffic from the firewall or could it be something to worry about?

[lobstercreed]

Do you have active scanning turned on for the LAN interface?  This sounds like that feature.

[Wilnel]

how do I tell? If it is on shouldn't it be hitting more than one pc?

[Wilnel]

i do see active scanning is on

[lobstercreed · Accepted solution]

It might depend on the security profile of that PC.  Also, the firewall has to have Layer 2 adjacency to the device in question.  If there is another router in-between, it would not be able to scan those.  If Symantec is configured exactly the same on more than one PC in that network, I would think it would affect more than one, yes. 

The source address being the firewall though seems to indicate that it must be this though and not a random attacker from the Internet.  It would have the attacker's IP address if it was, right?

[Wilnel]

I wonder why I cant see the traffic of the firewall scanning the pc.

[lobstercreed]

Can't see it where?  In the logs?  I'm not sure what log you would expect to see it under if it's initiated by the FortiGate itself.  You could try turning that feature off and see if you continue to get any alerts from Symantec.