Too many connection to Google

[Jirka1]

Hello, the last two days we have solved an interesting problem. Some PCs generate thousands of connections to IP address 172.217.23.206 which is Google. It went so far as that NAT table has overflowed (over 400,000 NAT connections) on our backbone box (ASR 1001). NAT is done so that each internal subnet / 24 is NAT to one public IP address. We have the FGT100D in transparent mode,  UTM (AV, IPS, APP, WEB), blocked QUIC and HTTSP inspection (not full). According to NAT logs from ASR, we identified the PCs that generate these thousands of connections, checked several times for the presence of viruses, spyware, etc. Everything is clean. The stations are Windows 7 and 10.

Anyone have any idea what this might be? Can it be a cause of QUIC blocking?

Below is part of the logs from FAZ

date=2017-11-10 time=12:32:33 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:33 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:33 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:33 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:33 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:29 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:30 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:30 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:30 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:29 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:29 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd
date=2017-11-10 time=12:32:29 type=traffic subtype=forward action=close app=HTTPS dstcountry="United States" dstip=172.217.23.206 dstport=443 osname=Windows proto=6 service=HTTPS srcip=172.22.71.45 srcmac=f0:4d:a2:22:30:bd

Thanks for tip. Jirka