Constant firewall blocking alerts
Several computers on my network began to display the firewall blocking alert with the description of NMAP TCP scan, but all computers in NAT protected by a Security Gateway, and these attacks start from several remote addresses, some coming from google, amazon and akamai .
But I realized that these warnings started to appear after activating the DPI-SSL feature (Deep Packet Inspection of Secure Socket Layer) that
Inspect SSL traffic When the client is on the firewall's LAN, and accesses content located on the WAN.
Really I can be suffering an attack or F-Secure may be interpreting wrongly the DPI-SSL feature?
Could you tell us is Intrusion Prevention is enabled on your end-points?
If so could you try disabling it to see if you still get alerts?
See this article on this feature.0 Like