From my SIEM I am seeing that a (we don't own the FW) Cisco ASA is blocking packets destined for the internal network (post NAT), here's what I'm seeing (IP addresses are faked due to security)
170.100.1.1 External Host (A)
Firewall
192.168.1.1 Internal Host (A) | | 192.168.1.2 Internal Host (B) | | 192.168.1.3 Internal Host (C)
Example of the SIEM report/Firewall deny
"Deny udp src outside:170.100.1.1/3478 dst inside:(any of the internal hosts)/5219 by access-group "outside_access_in""
We're in a bit of a pickle due to us not owning the FW, nor are we able to see the logs, so I can't see the specific rule nor can I see the specific packets
How can the external source know the private address of the internal hosts if it hasn't already been in contact with the hosts i.e. why would the Firewall randomly block the packets?
The ports are completely random, all empheral and none within the assigned port ranges.
I need some help please!!!