Open DNS showing as attacking new firewall

Question

I just installed a new firewall XG115 at a customer. They have internal DNS servers and I have setup the forwarders to use open DNS servers. I also setup open DNS servers as the DNS servers for the new firewall. 
 It has been running for about 4 days and when looking at the console it shows 1181 hits from Open DNS server 208.67.222.222. 
 Can someone shed some light on why it would think the Open DNS server is attacking the firewall? 
 
 Thanks, 
 J

lferrara · Answer

Joey, 
 if you see the attack, you are using IPS on some firewall rules. Go to Reports > Network & Threats > Intrusion Attacks and find which intrustion attack is matched. Go to the affecting IPS rule and remove the attack pattern. 
 Please note that XG uses Snort, which is signature-based IPS, so false-positive can occur. 
 Regards

lferrara · Answer

Joey, 
 check the IPS profile attached to Defaul_Network_Policy and remove the affected IPS pattern (if you think the attack is a false positive). 
 Regards