WAN Deny Port 137

[MattHLC]

Seeing this log constantly: Message meets Alert condition date=2017-11-16 time=22:42:05 devname=FG101E devid=xxxxxxxxxxx logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=172.16.0.2 srcport=137 srcintf="wan1" dstip=172.16.0.255 dstport=137 dstintf="wan1" sessionid=30469067 proto=17 action=deny policyid=0 policytype=policy dstcountry="Reserved" srccountry="Reserved" trandisp=noop service="udp/137" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat="unscanned" crscore=30 craction=131072 crlevel=high Note, this was from 172.16.0.2 to 172.16.0.255, most of the time the logs are generating from 169.254.x.x to 169.254.255.255.

[packetpusher]

What is the question?

[MattHLC]

What would generate this traffic from WAN to WAN? WAN1 is working correctly otherwise and LAN1 has a 192.168.x.x subnet only. WAN2 however is trying to obtain an IP as it’s set to DHCP but I am pretty sure there isn’t any other WAN connection and someone just ticked it to the on position. I can see that the WAN to WAN is deny but don’t see anything in the WAN config that would do this behavior. I am new to FortiGates and am getting these alerts all day but only on this one unit.

[tanr]

Looking at the log entry, it looks like you've got a private IP to private IP (meaning IPs within subnets that are only supposed to be used for private networks) broadcast of Netbios NS, which is getting denied by your default deny security policy, meaning you don't have an explicit security policy to allow or deny it.

The thing that is off is that this is coming in your wan1 interface.  Assuming your wan1 interface is actually connected to the wan you shouldn't be getting netbios from there, since it is a non-routable protocol.

More information on your config, situation, and what your actual question is would be helpful.

[tanr]

If you're also getting this from 169.254.x.x then its likely some device that hasn't yet got its own IP through DHCP.

Is wan1 a static IP? Does it have any secondary IP Addresses set? What's directly connected to the wan1 port? If it's a cable modem or similar, what is its local (not public) IP?  And is anything else plugged into that modem/device?

I've seen one similar issue (DHCP and netbios on a wan port) with a messed up multi-tenant configuration provided by an ISP.

I'm assuming/hoping you don't have wan1 or wan2 set as DHCP servers?  Just to be sure, you should probably check what DHCP clients the FortiGate does have (Monitor, DHCP Monitor).

[packetpusher]

Can you deny 137/UDP outbound (LAN-192.168.x.x -> WAN)? Then provide  di sniffer packet wan1 "port 137" 4 10 l

[packetpusher]

I guess I hit the send button too early. I suspect Proxy Arp inspection. Please, provide the output of show system proxy-arp.

Thanks

[packetpusher]

Do you have the following configuration forwarding NetBIOS request to WINS server on the internal interface ?

 config system interfaceedit internalset netbios_forward enableset wins-ip x.x.x.xend