Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Strange "external" traffic destined for my Orion Server???

Our firewall logs show an error (more than a couple of times a minute) that reads: "No translation group found for udp src outside:172.16.1.75/514 dst inside:10.1.0.70/514".

Although our WAN consists of 30 remote offices, connected to our data center (where Orion "lives") none of our offices or locations use "172.16.xxx.xxx" address space. UDP 514 should be syslog, however I have not opened that port up through my firewall nor do I have any sort of "outside to inside" translation through my firewall to Orion.

Does anyone have any idea what could be causing this traffic?

Brian

Find more posts tagged with

Accepted answers

All comments

njoylif

off top of my head...if orion is sending requests to remote devices, and there is no translation, the source will go unchanged so the remote device would craft the reply using the 172.xxx address

rschroeder

Hi Brian,

When I saw similar traffic at my firewalls, I looked for routing statements that might involve the source or destination. I did packet captures at the firewall, and eventually discovered our WAN provider had inadvertently spanned a VLAN across two ports that should not have been spanned. It ended up putting two businesses on the same network, when they should have been isolated from each other. That's one possibility you should look into.

If you can find firewall routing or rules that affect this traffic, you may be onto a path to follow. If not, traceroute & find the end devices that offend. Find who owns/manages them, find their routing statements, and take the steps you need to either stop or allow them.

Rick