topic Re: WSA in Web Security

WSA

ccg-security — Thu, 24 Oct 2019 14:44:39 GMT

We would like to know why is that our WSA is communicatiing in public using 445?

balaji.bandi — Thu, 24 Oct 2019 07:33:56 GMT

The IP provided belong to apple - apple.parklogic.com

So better look at console what device is try to communicated, Do you have any apple device in the network. ?

here port information :

ccg-security — Thu, 24 Oct 2019 13:22:23 GMT

Hello Balaji,

How can we look at console what device is try to communicated?

balaji.bandi — Thu, 24 Oct 2019 14:13:46 GMT

Looging to WSA using SSH

once you see below prompt follow same steps :

> grep

>1 (this is for access logs)

>45.79.222.138

> N

> Y

> N

then you can see real-time which IP address contacting that server.

or you can also do report on GUI destination type IP address - 45.79.222.138

shgrover — Thu, 02 Jan 2020 01:43:34 GMT

TCP 445 is used for SMB communication. check if the WSA is trying to communicate with the AD. Is your AD on the outside?

Regards

Shikha Grover

PS: Please don't forget to rate and select as validated answer if this answered your question.