Snort blocking VPN traffic
-
My wife and I both work from home. We both use Cisco anyConnect to connect back to our corporate offices. We work for 2 different companies. Snort will flag this as suspicions and then block the IP.
I have seen some notes about adding the VPN address to the white list. We both work for 100k+ employee companies. The VPN IP is not static and can be any number of different VPN IPs. This list would get long and would get annoying to have to keep adding IPs to the whitelist.
Is there a better way to allow VPN traffic on the LAN? Ideally I'd like to make it so any VPN traffic originating from the LAN is allowed. Or maybe any VPN traffic from a specific mac address?
Tons of these
-
Why don't you just disable that rule instead? It is an ET Policy rule. Those are usually used just for notification or to enforce some corporate policy. You've discovered that it is falsely triggering in your network due to the VPN traffic (a false positive), so just disable it. Click the red X under the GID:SID column in the ALERTS tab.
