Sangfor Access Secure - 1.2.3.4 traffic

cgsi_yap Lv1Posted Mar-21-2026 17:18

This is our network security team's concern. We found all the atrust clients send traffic to 1.2.3.4

What is this 1.2.3.4 for? Based on FW log, all this outgoing traffic to 1.2.3.4 is blocked but we have no issue to access any applications.

Damai_Group has solved this question and earned 20 coins.

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

The IP address 1.2.3.4 is a virtual endpoint used by the Sangfor aTrust client for internal connectivity checks, such as pinging or verifying the virtual adapter’s status. Since these probes are separate from actual user traffic, blocking them at the firewall does not affect access to business applications—all real traffic still flows through the established VPN tunnel. Therefore, this activity poses no security risk and can either be ignored or allowed to clean up the firewall logs.
Is this answer helpful?
Achmad Tegar S Lv1Posted Mar-21-2026 20:00
  
Hi, as far as i know IP address 1.2.3.4 acts as a dummy address that Sangfor uses to intercept and redirect your web traffic to a auth login or policy page.
Damai_Group Lv1Posted Mar-21-2026 20:01
  
The IP address 1.2.3.4 is a virtual endpoint used by the Sangfor aTrust client for internal connectivity checks, such as pinging or verifying the virtual adapter’s status. Since these probes are separate from actual user traffic, blocking them at the firewall does not affect access to business applications—all real traffic still flows through the established VPN tunnel. Therefore, this activity poses no security risk and can either be ignored or allowed to clean up the firewall logs.
cgsi_yap Lv1Posted Mar-22-2026 00:27
  
endpoint is keep sending traffic to 1.2.3.4 and it is blocked at firewall. If the IP is used by endpint internally, why we can see the traffic at external firewall?
cgsi_yap Lv1Posted Mar-25-2026 11:17
  
hi guys, received reply from Sangfor Support.

Info Sharing
1. 1.2.3.4 is a virtual gateway IP designed to automatically identify and connect to the appropriate POP gateway once traffic from ingress clients is routed to it.
2. The outbound firewall is observing traffic to 1.2.3.4 because the tunnel between the endpoint and the POP node was not successfully established. As a result, the client attempts to reach 1.2.3.4 directly via its physical network interface.
3. When the connection to the POP node is successfully established, the traffic will be encapsulated and forwarded to the POP. In this case, direct access logs to 1.2.3.4 will no longer appear on the outbound firewall.
4.This traffic is expected behavior and cannot be disabled. It is continuously initiated by the client to ensure reliable connectivity to the gateway.

I Can Help:

Change

Moderator on This Board

13
4
0

Started Topics

Followers

Follow

941
192
97

Started Topics

Followers

Follow

Trending Topics

Board Leaders