Constant IPsec AH Packet Dropped message.
jharlfinger
Newbie ✭
Hello, I keep getting a message about IPsec AH Packets being dropped from one of my Ubuntu Nginx proxy servers. The destination is the VRRP multicast address and the catagory is VPN which is strange. Is there a reason why this is happening? Nothing seems to be wrong with the servers and their functions but I would like to find the reason these messages keep coming up and filling the logs. Does anyone know what this message exactly means?
I have a Global and SSL VPN running. This is on a TZ400 with the latest firmware.
Best Answer
-
CORRECT ANSWERMarkD
Cybersecurity Overlord ✭✭✭
If its a case of these devices communicaing with each other and its the event logged to the FW you dont want to see (its a m'cast to all devices on the subnet so seen by the firewall) You should be able to click the X in the event log and the FW will no longer log this message.
0
Answers
Ubuntu Nginx one for the Ubuntu Community
What do you mean? Are you saying I should go ask the Ubuntu community? This is clearly more of a sonicwall thing as the service is working fine but I keep getting these messages and I want to know if its safe to ignore them or look into them.
I would ask why the Ubuntu is generating AH packets to a multicatst address, not why the firewall is dropping them....
Sounds good, I just wanted to make sure it was not somthing to worry about. Thanks for the Info!