WSA

[ccg-security]

We would like to know why is that our WSA is communicatiing in public using 445? 

[balaji.bandi]

The IP provided belong to apple - apple.parklogic.com

So better look at console what device is try to communicated, Do you have any apple device in the network. ?

here port information :

https://support.apple.com/en-is/HT202944

[ccg-security]

Hello Balaji,

How can we look at console what device is try to communicated?

[balaji.bandi]

Looging to WSA using SSH

once you see below prompt follow same steps :

 > grep

>1 (this is for access logs)

>45.79.222.138

> N

> N

> Y

> N

then you can see real-time which IP address contacting that server.

or you can also do report on GUI destination type IP address - 45.79.222.138

[shgrover]

Hello   ccg-security,

TCP 445 is used for SMB communication. check if the WSA is trying to communicate with the AD. Is your AD on the outside?

Regards

Shikha Grover

PS: Please don't forget to rate and select as validated answer if this answered your question.