LAN to WAN Attack in Secureport
Secureport shows an "Attack" with the Source address being one of my internal workstations (192.168.nnn.nnn), and the destination a WAN address: 138.201.57.222.
I am not able to identify the purpose of the connection to 138.201.57.222
Nor can I identify why Zyxel considers the connection an "Attack".
How do I find out why is this considered an "Attack"?
What is 138.201.57.222?
0
All Replies
-
Hi @GeoGuyOwoWelcome to Zyxel community.You can refer to the below forum discussion link:The cause is that the session was initiated by the host (192.168.nnn.nnn) on your LAN side andaccessed the data from the destination WAN IP(138.201.57.222),then Zyxel UTM engine identified this behavior might be a malicious attack so blocked it.You can check it belongs to which attack type on the category item such as ADP, IDP, etc.
You may provide the screenshot to us. Thanks.Don't miss this great chance to upgrade your Nebula org. for free! https://bit.ly/4g2pS9L
0
Categories
- All Categories
- 415 Beta Program
- 2.3K Nebula
- 141 Nebula Ideas
- 94 Nebula Status and Incidents
- 5.5K Security
- 216 USG FLEX H Series
- 262 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 1K Wireless
- 39 Wireless Ideas
- 6.3K Consumer Product
- 243 Service & License
- 382 News and Release
- 81 Security Advisories
- 27 Education Center
- 8 [Campaign] Zyxel Network Detective
- 3K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 83 About Community
- 71 Security Highlight