Security Center

[JessIT1]

Morning all: Saw this Source - IP with Action - Allowed on (2) of our firewall's external WAN IP's as the Destination.

Not sure why it was allowed..

I immediately added 95.214.52.173:500 & 95.214.52.173 to our Meraki Content Filtering - URL Filtering Block List and added a Layer 7 Deny rule for 95.214.52.173:500

[nishmeNtic]

3 new IP's - this is getting out of hand.

98.27.28.1

69.69.69.70

98.27.12.6

[JessIT1]

yep, got those as well, added to my layer 7, layer 3 deny list, crazy.

[james.thornhill1]

Yep, added those to my ever growing list too

[james.thornhill1]

Some new IP's to block

87.120.166.69:500
87.120.166.70:500
70.70.70.72:500
87.120.166.231:500
87.120.166.69:500

[JessIT1]

I also received those IP's. However I recently replaced 3 of my firewalls that could no longer could receive firmware updates, and now the Zyxel unauthenticated IKEv2 command injection attempt and Zyxel unauthenticated IKEv2 overflow attempts that have been plaguing our MX's since February now show blocked instead of allowed..so I guess getting these MX's up to the latest MX 18.211.2 version allowed the

Intrusion detection and prevention to block..strange.

[nishmeNtic]

Which MX couldn't receive updates? Which model are you using now? Thanks

[dunky]

I've got the issue on an MX84 which cannot be upgraded (its on 18.107.11), although its running at 33%+ utilization which may be the issue rather than the firmware version

[nishmeNtic]

same, i just checked it wont allow firmware upgrades higher on MX84. I got to check when these will be eol.

[dunky]

MX84 End-of-Support is Oct 31, 2026

[JessIT1]

Wow, 2026, might have jumped the gun then.. My thought was just since firmware updates had reached EOL that I did not want any lapse in security to be our downfall. And again, odd that after I upgraded all those rogue IP's showing allowed, now show blocked, maybe a coincidence..

[dunky]

@JessIT1 What utilization was the old MX running at compared to the new one?

[JessIT1]

Not sure, did not check that. How do you check an MX's utilization?

[JessIT1]

MX64, MX64W, MX84 could not go past 18.200. Now using MX 67, MX67W, MX95

[nishmeNtic]

another cash grab to update all these older ones.

[JessIT1]

We were going on 8 years of running those 3 MX's we replaced.