Invalid Traffic Denied

Question

In CR15iNG 
 There is no connectivity issue but this error appear. Any idea to fix this.

Keyur · Accepted Answer

Hi Can carmack Could you please confirm the status of PING for the WAN interface? Please go to System >> Administration >> Appliance Access What is the IP address of your WAN Interface? As per the logs ICMP traffic is receiving on Port B from WAN side. For more details on Invalid Traffic, please refer to the below article. 
 https://community.sophos.com/kb/en-us/131754 
 Note: It is only critical to worry about Invalid traffic entries if there is a problem of disconnection or inaccessibility.

Keyur · Answer

Hi Can carmack For security reasons, you may disable ping for WAN and DMZ zone. 
 As per the logs, traffic from 212.156.63.157 coming from the WAN zone and Cyberoam denied the packets as per the configuration. You may take access of SSH console of the Cyberoam and login to console access and execute the command to see the request from the IP. tcpdump 'host 212.156.63.157, if there are many request, you can notify your ISP to block the traffic from this specific IP in your WAN link

Keyur · Answer

Hi Can carmack The ICMP traffic generated for .157 from .158 is correct and you do not have to worry about anything. As per the failover rules configured for WAN interface, The IP will keep pinging the gateway IP configured to verify the gateway status (Up and Down), If the configured IP will not be reachable for a configured time, It will declare the gateway as down, you can modify failover rules to some other IP as per your requirement such as 8.8.8.8. The given article has Failover details, please check - https://community.sophos.com/kb/en-us/130649#GF

Keyur · Answer

Hi Can carmack As I have shared the details in the previous post, it will work as expected but you may contact technical support to verify it further.

Keyur · Answer

Hi Can carmack As both the gateway configured as active, Gateway failover timeout value change does not require. As I have explained the mechanism in the previous post, The status of the gateway Green (Up) Red (Down) to determine it, it will use ping or whatever condition is configured. I assure you that it is a legitimate behavior and you do not require to take any action upon it.