Fortinet Question - IP and Ports being reported to security systems

Started by deanwebb, April 08, 2021, 09:24:55 AM

Previous topic - Next topic
Print
Go Down Pages1
User actions

deanwebb

April 08, 2021, 09:24:55 AM
Yo, Wintermute!

We're seeing a situation in which Fortinet firewalls are reporting IP addresses and/or open ports on devices where there's no host at the IP address and no such open port on the device. The common factor is a Fortinet firewall in the path. Is there any setting on the Fortinet that we should check to modify/stop the behavior?
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

wintermute000

#1
July 06, 2021, 07:34:32 AM
can you be more specific about Fortinet firewalls reporting IP addresses / open ports? What exactly is the report or screen or output you're seeing?

deanwebb

#2
July 07, 2021, 09:48:30 AM
This would be reporting via ARP tables and/or responses to NMAP scans.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

Otanx

#3
July 07, 2021, 11:53:22 AM
sounds like proxy arp is enabled.

-Otanx

wintermute000

#4
July 12, 2021, 04:15:35 AM
I still don't get what its 'reporting'. The FW isn't running NMAP scans or anything like that?
If you mean that when its responding, then yep proxy ARP because theres a VIP or NAT etc.

deanwebb

#5
July 12, 2021, 01:03:59 PM
Responding, so I'll check on the proxy ARP.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.
Print
Go Up Pages1
User actions