IPS attacks with source IP addresses of UTM

Hi Meghan,

Start a thorough Anti Virus scan on the internal systems whose source IP addresses are captured in the report. Next, make sure the IPS patterns are up2date. 

Thanks

Hi Meghan,

Start a thorough Anti Virus scan on the internal systems whose source IP addresses are captured in the report. Next, make sure the IPS patterns are up2date. 

Thanks

Hi Sachin,

the source IP adresses are the IP of the UTM appliance.

Regards

Hi Meghan,

What is the destination IP in those drops, internal LAN IP external addresses? Alongside, are the patterns are up2date? 

This could be a possible DNS cache poisoning attempt on your IP address which is dropped by the UTM's ATP module. The quick fix is to get your public IP address changed by the ISP. Alongside, go to Management | up2date and verify that the UTM patterns are up to date. This could also be caused by a pattern update and probably a false positive.

Thanks