Message meets Alert Condition

[safpiper]

Hi

This looks like an attempt to come in from Germany via the VPN? Am I reading this right?

Message meets Alert condition date=2020-06-24 time=15:05:27 devname=FGT90D3Z14005423 devid=FGT90D3Z14005423 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=10.212.134.204 srcport=49469 srcintf="ssl.root" dstip=17.130.21.5 dstport=443 dstintf="wan1" sessionid=44223017 status=deny policyid=0 dstcountry="Germany" srccountry="Reserved" trandisp=noop service=HTTPS proto=6 duration=0 sentbyte=0 rcvdbyte=0

[lobstercreed]

No, this looks like a user trying to reach a German website through your VPN (evidently you are not using split-tunnel).  Notice the destination is Germany.  The source is 10.212.134.204 on your SSL VPN (ssl.root) tunnel.

[Toshi_Esumi]

By the way, the destination IP belongs to Apple. And, based on the ping latency from my current position, it seems to be reasonable to be in Europe.

Source:  whois.arin.net IP Address:  17.130.21.5 Name:  APPLE-WWNET Handle:  NET-17-0-0-0-1 Registration Date:  4/16/90 Range:  17.0.0.0-17.255.255.255 Org:  Apple Inc. Org Handle:  APPLEC-1-Z Address:  20400 Stevens Creek Blvd., City Center Bldg 3 City:  Cupertino State/Province:  CA Postal Code:  95014 Country:  United States

[ede_pfau]

The interesting part IMHO is the source address. It's from a private range which looks like coming from a mobile device to me.

You cannot really avoid having your VPN gateway accessed by unsolicited sources. You can create a 'local-in' policy with geo-location source addresses to whitelist or blacklist countries, and you should have user quarantine in place for too many failed login attempts.