Solved

SonicWall Network Access entries in Logs

Posted on 2015-01-04
2
243 Views
Last Modified: 2015-01-04
I recently upgraded our router to a SonicWall TZ215W

Our main network is on the 192.168.1.0/24 network and there are 8 site to site VPN tunnels enabled with one of them on the 192.168.3.0/24 network.

All of the tunnels are setup and seem to work great.

When I look at the logs, I am repeatedly getting the following entries:

01/04/2015 10:50:32.896      Notice      Network Access      TCP connection dropped      192.168.1.151, 56917, X0      192.168.3.106, 9100, X1      TCP Port: 9100

01/04/2015 10:50:12.736      Notice      Network Access      UDP packet dropped      192.168.1.113, 63325, X0      192.168.3.200, 161, X1      UDP SNMP

01/04/2015 10:37:52.672      Notice      Network Access      UDP packet dropped      192.168.1.151, 64802, X0      192.168.3.106, 161, X1      UDP SNMP
             
3      01/04/2015 10:37:36.496      Notice      Network Access      TCP connection dropped      192.168.1.117, 56738, X0      192.168.3.200, 9100, X1      TCP Port: 9100



The source IP's (192.168.1.151, 192.168.1.117, 192.168.1.113) are valid PCs on the main network, but the destination IPs are not on the remote network.

1.151 is always trying to access 3.106
1.117 is always trying to access 3.200
1.113 is always trying to access 3.200
0
Comment
Question by:pmitllc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
2 Comments
 
LVL 6

Author Comment

by:pmitllc
ID: 40530315
I ran wireshark on the 1.151 system and see this entry for the above destination:

192.168.1.151      192.168.3.106      TCP      62      [TCP Spurious Retransmission] 57380→9100 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
0
 
LVL 6

Accepted Solution

by:
pmitllc earned 0 total points
ID: 40530668
Apparently a lot of these systems still had old printers locally installed that were pointing to these destinations.  

Once they were removed, the notices went away.
0

Featured Post

Surfing Is Meant To Be Done Outdoors

Featuring its rugged IP67 compliant exterior and delivering broad, fast, and reliable Wi-Fi coverage, the AP322 is the ideal solution for the outdoors. Manage this AP with either a Firebox as a gateway controller, or with the Wi-Fi Cloud for an expanded set of management features

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco ASA 5505's for VPN study 15 62
Draytek (Site to Site VPN using IPSec) 6 67
Public DNS  Vs BGP 20 58
SSL-VPN 1 51
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question