So when this happens the attack or false positive is directed at the device with the VPN. The address/ IP is the same as the VPN server address directed towards my IPad in this scenario. My Intrusion Prevention is dropping 20 packets a second when this happens. Sometime the very last digit is off by one number from the IP presented by the VPN. So if the app says 98.142.213.24, the intrusion prevented address might be 98.142.213.23.
I’m sending some pics along with this message. The source port and destination port are 4500. When the Intrusion Prevention blocks this signature the internet is blocked. I then switch to another location and until the system blocks that new IP I am able to surf the web.
Is this a false positive? From what I’ve read online there is no known false positives for this code.
