VPN attack?

rookierunner

Over the past week, I am seeing a significant number of entries in the logs about multiple IP addresses trying to connect into my VPN, showing up as 'Info' priority in the IKE category with a message of "The cookie pair is: ….". I haven't seen this in my logs before. Anyone seen them before and anything I need to do?  Seems like they are unsuccessful in connecting but it seems weird that they just started out of the blue.

Zyxel_Stanley

Hi @rookierunner

Yes, you are correct.
Go to Configuration > Object > Address/GeoIP > Address. and click "Add" button to create address. And then grouping them as an address group.

Zyxel_Stanley

Hi @rookierunner

In the default configuration, device allows IKE request from internet. 

According your situation, it may come from unknown user who entered wrong address in the VPN proposal.

If the requested address is unknown source IP, you can drop them by policy control rule.

Stanley

rookierunner

@Zyxel_Stanley,

Thanks for the response! I am assuming that the “unsafe” address group is a custom one that I would define and add specific IP addresses to as they show in my log, correct?

Zyxel_Stanley

Hi @rookierunner

Yes, you are correct.
Go to Configuration > Object > Address/GeoIP > Address. and click "Add" button to create address. And then grouping them as an address group.