I am currently trying to troubleshoot a weird issue.
A few months back our SOC informed me, that some systems on our network are trying to reach malicious IP addresses on the internet.
After checking what the source is it turns out, that those are gateway IP addresses assigned to public network segments, that are attached to our Tier-1 Gateways.
Our perimeter firewall drops the connections, but I cannot find a reason for the logs to show that the source is a gateway IP address. No NAT rules are set on either the T1 nor T0 gateways. Testing with a VM in one of the attached public network segments (ICMP form the VM to an outside system) shows the correct source IP (of the VM).
There are about 1000 of those events per day, per gateway IP.
My NSX version is 4.2.3.1.0.24954571. Unicast Reverse Path Forwarding (uRPF) is set to strictt, there are no NAT rules set. I could not find anything related to this issue in the release notes, or other sources.
Has anyone experienced something similar?
edit: nevermind, after a quick search I found out that the ICMP packets are of type 3 (Host unreachable) and are sent by the gateway when an external source tries to port scan an IP on our public network, that is not assigned yet to any active network adapter of a VM. I need to find a way now to filter those out.