OpManager broadcasts causing FW alerts
I have OpManager with the NFA plugin (Build 7400 {
SP-7.0+SP-1.0+SP-2.0+SP-4.0}. I have noticed in my FW logs a lot of warnings and
I've traced them down, done a packet capture and found that OpManager is blasting broadcast messages at an alarming rate (in the below example, in less than one minute, 112 were generated and of those only 4 were not from OpManager)
1: 13:39:26.091044 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
2: 13:39:26.840822 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
3: 13:39:27.590881 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
4: 13:39:33.043805 10.1.0.9.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
5: 13:39:33.804355 10.1.0.43.137 > 10.1.0.255.137: udp 50
6: 13:39:34.554231 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
7: 13:39:35.304290 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
8: 13:39:36.557908 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
9: 13:39:37.307387 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
10: 13:39:38.057415 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
11: 13:39:40.754477 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
12: 13:39:41.503986 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
13: 13:39:42.253999 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
14: 13:39:43.004775 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
15: 13:39:43.004821 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
16: 13:39:43.004852 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
17: 13:39:43.004882 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
18: 13:39:43.754172 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
19: 13:39:43.754218 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
20: 13:39:43.754248 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
21: 13:39:43.754279 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
22: 13:39:44.504154 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
23: 13:39:44.504215 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
24: 13:39:44.504246 10.1.0.43.137 > 10.1.0.255.137: udp 50
25: 13:39:44.504292 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
26: 13:39:45.254823 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
27: 13:39:45.254869 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
28: 13:39:45.254915 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
29: 13:39:45.255052 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
30: 13:39:45.255586 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
31: 13:39:45.255693 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
32: 13:39:46.004379 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
33: 13:39:46.004424 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
34: 13:39:46.004455 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
35: 13:39:46.004470 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
36: 13:39:46.005264 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
37: 13:39:46.005386 10.1.0.43.137 > 10.1.0.255.137: udp 50
38: 13:39:46.754355 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
39: 13:39:46.754401 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
40: 13:39:46.754431 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
41: 13:39:46.754447 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
42: 13:39:46.755209 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
43: 13:39:46.755240 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
44: 13:39:47.505131 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
45: 13:39:47.505283 10.1.0.43.137 > 10.1.0.255.137: udp 50
46: 13:39:47.505558 10.1.0.43.137 > 10.1.0.255.137: udp 50
47: 13:39:47.506031 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
48: 13:39:47.506336 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
49: 13:39:47.506794 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
50: 13:39:48.254411 10.1.0.43.137 > 10.1.0.255.137: udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed
51: 13:39:48.255388 10.1.0.43.137 > 10.1.0.255.137: udp 50
52: 13:39:48.255418 10.1.0.43.137 > 10.1.0.255.137: udp 50
53: 13:39:48.255434 10.1.0.43.137 > 10.1.0.255.137: udp 50
54: 13:39:48.256364 10.1.0.43.137 > 10.1.0.255.137: udp 50
55: 13:39:48.256364 10.1.0.43.137 > 10.1.0.255.137: udp 50
56: 13:39:49.004501 10.1.0.43.137 > 10.1.0.255.137: udp 50
57: 13:39:49.005401 10.1.0.43.137 > 10.1.0.255.137: udp 50
58: 13:39:49.005447 10.1.0.43.137 > 10.1.0.255.137: udp 50
59: 13:39:49.005462 10.1.0.43.137 > 10.1.0.255.137: udp 50
60: 13:39:49.006377 10.1.0.43.137 > 10.1.0.255.137: udp 50
61: 13:39:49.007079 10.1.0.43.137 > 10.1.0.255.137: udp 50
62: 13:39:49.755087 10.1.0.43.137 > 10.1.0.255.137: udp 50
63: 13:39:49.755942 10.1.0.43.137 > 10.1.0.255.137: udp 50
64: 13:39:49.757101 10.1.0.43.137 > 10.1.0.255.137: udp 50
65: 13:39:49.757483 10.1.0.43.137 > 10.1.0.255.137: udp 50
66: 13:39:50.504566 10.1.0.43.137 > 10.1.0.255.137: udp 50
67: 13:39:50.505512 10.1.0.43.137 > 10.1.0.255.137: udp 50
68: 13:39:50.506489 10.1.0.43.137 > 10.1.0.255.137: udp 50
69: 13:39:50.507450 10.1.0.43.137 > 10.1.0.255.137: udp 50
70: 13:39:50.876938 10.1.0.52.137 > 10.1.0.255.137: udp 50
71: 13:39:51.254625 10.1.0.43.137 > 10.1.0.255.137: udp 50
72: 13:39:51.255602 10.1.0.43.137 > 10.1.0.255.137: udp 50
73: 13:39:51.256548 10.1.0.43.137 > 10.1.0.255.137: udp 50
74: 13:39:51.257539 10.1.0.43.137 > 10.1.0.255.137: udp 50
75: 13:39:56.532305 10.1.0.68.137 > 10.1.0.255.137: udp 50
76: 13:39:56.533328 10.1.0.68.137 > 10.1.0.255.137: udp 50
77: 13:40:00.108301 10.1.0.43.137 > 10.1.0.255.137: udp 50
78: 13:40:00.857835 10.1.0.43.137 > 10.1.0.255.137: udp 50
79: 13:40:01.607909 10.1.0.43.137 > 10.1.0.255.137: udp 50
80: 13:40:02.358654 10.1.0.43.137 > 10.1.0.255.137: udp 50
81: 13:40:02.358669 10.1.0.43.137 > 10.1.0.255.137: udp 50
82: 13:40:02.358746 10.1.0.43.137 > 10.1.0.255.137: udp 50
83: 13:40:02.358822 10.1.0.43.137 > 10.1.0.255.137: udp 50
84: 13:40:02.358837 10.1.0.43.137 > 10.1.0.255.137: udp 50
85: 13:40:02.358883 10.1.0.43.137 > 10.1.0.255.137: udp 50
86: 13:40:02.358929 10.1.0.43.137 > 10.1.0.255.137: udp 50
87: 13:40:02.358990 10.1.0.43.137 > 10.1.0.255.137: udp 50
88: 13:40:02.359081 10.1.0.43.137 > 10.1.0.255.137: udp 50
89: 13:40:02.359097 10.1.0.43.137 > 10.1.0.255.137: udp 50
90: 13:40:03.108057 10.1.0.43.137 > 10.1.0.255.137: udp 50
91: 13:40:03.108102 10.1.0.43.137 > 10.1.0.255.137: udp 50
92: 13:40:03.108102 10.1.0.43.137 > 10.1.0.255.137: udp 50
93: 13:40:03.108118 10.1.0.43.137 > 10.1.0.255.137: udp 50
94: 13:40:03.108972 10.1.0.43.137 > 10.1.0.255.137: udp 50
95: 13:40:03.109048 10.1.0.43.137 > 10.1.0.255.137: udp 50
96: 13:40:03.109064 10.1.0.43.137 > 10.1.0.255.137: udp 50
97: 13:40:03.109079 10.1.0.43.137 > 10.1.0.255.137: udp 50
98: 13:40:03.109094 10.1.0.43.137 > 10.1.0.255.137: udp 50
99: 13:40:03.109094 10.1.0.43.137 > 10.1.0.255.137: udp 50
100: 13:40:03.858064 10.1.0.43.137 > 10.1.0.255.137: udp 50
101: 13:40:03.858079 10.1.0.43.137 > 10.1.0.255.137: udp 50
102: 13:40:03.858079 10.1.0.43.137 > 10.1.0.255.137: udp 50
103: 13:40:03.858094 10.1.0.43.137 > 10.1.0.255.137: udp 50
104: 13:40:03.858994 10.1.0.43.137 > 10.1.0.255.137: udp 50
105: 13:40:03.859055 10.1.0.43.137 > 10.1.0.255.137: udp 50
106: 13:40:03.859071 10.1.0.43.137 > 10.1.0.255.137: udp 50
107: 13:40:03.859086 10.1.0.43.137 > 10.1.0.255.137: udp 50
108: 13:40:03.859086 10.1.0.43.137 > 10.1.0.255.137: udp 50
109: 13:40:03.859086 10.1.0.43.137 > 10.1.0.255.137: udp 50
110: 13:40:04.608778 10.1.0.43.137 > 10.1.0.255.137: udp 50
111: 13:40:05.358181 10.1.0.43.137 > 10.1.0.255.137: udp 50
112: 13:40:06.108286 10.1.0.43.137 > 10.1.0.255.137: udp 50
When I stop the OpManager service, they stop and in the last 5 minutes I've only had 35 from the rest of my servers and services.
Is there a way to stop the broadcasts?