Website Blocking - External IP As Source

Hai Sangforian,

We are using Sangfor NGAF, when generate report on Monitor>Logs>Security Logs(type: Website Access Blocking)

We notice source zone is external IP that trying to access block website. We understand if the source zone is internal IP is normal.

Can someone explain why source zone, external IP that trying to access block website and the destination is our internal IP.

Thank You

Hi, usually when external IP trying to access to a website that leads to internal ip usually means that your server hosted to the public. At the same time, hackers sometimes spam ping to public ip to find out which of them is hosting web or services. This is to plant botnet to extract data in most cases when hackers do.

1. Add a new LDAP Server under the External Auth Server.
2. Enter the details such as Server Name, IP Address of the external authentication server, the admin account username and password and select the BaseDN. After entered all the details, click the Test Validity to check whether able to connect the external authentication server or not.
3. After tested the validity, a message will prompt out to show the result.
4. Click the Sync with all LDAP servers to sync all the data. Now, the configuration is successfully set.

When observing external IP addresses attempting to access blocked websites with the destination being internal IPs in the Sangfor NGAF security logs, it likely indicates attempted breaches or unauthorized access originating from outside the organization network. This scenario could suggest potential cyber threats such as phishing attempts, malware infiltration, or unauthorized access attempts targeting internal resources.

Hi,

below are some scenario on why you could see internal IP on the blocking logs.

1. attackers often use IP spoofing to mask their identities when trying to access restricted resources
2. if users within your network are using proxy servers to access internet
3. if users are connected to your network via VPN, there is a possibility that the source zone will show internal IP when accessing blocked websites

hackers try to send spam message just to invoke.
check the users for VPN proxy usage

Hi, when you notice external IP addresses trying to reach blocked websites, with the target being internal IPs as seen in the Sangfor NGAF security logs, it’s likely a sign of attempted violations or unauthorized access originating from outside the organization’s network.
Typically, when an external IP attempts to access a website that redirects to an internal IP, it often indicates that your server is publicly hosted. Concurrently, hackers may frequently ping public IPs to identify which ones are hosting websites or services.

Hi,

This should too be related to some kind of threshold of traffic from an external ip to yours websites that is blocking the ip after many requests from same source ip.

The NGAF is doing its job by preventing unauthorized access to your internal resources. The external IP attempting to access the blocked website is effectively thwarted by the firewall rules.

The NGAF is a powerful security solution that combines traditional firewall capabilities with intelligent detection and web application security. It’s designed to safeguard your network perimeter and protect against external threats.

In Sangfor NGAF, when you generate a report under Monitor > Logs > Security Logs with the type set to "Website Access Blocking," you observe that the source zone is an external IP address attempting to access a blocked website. This is not unusual, as external IPs can also try to access websites that have been blocked by your security system.

The source zone being an external IP indicates that the request originated from a device outside your network perimeter. The destination refers to your internal IP, which means the external IP is trying to access a resource within your network. This scenario typically occurs when the external user or device is attempting to reach a website or resource that has been blocked or restricted by your Sangfor NGAF firewall. The firewall is correctly identifying the external IP as the source zone and blocking the access to the internal IP, ensuring the security of your network.