So we rolled out Vendor X's shiny new next-gen firewalls six months ago. The promised "AI-driven threat intelligence" and "zero-trust traffic inspection." Great. Now we're seeing these massive, regular traffic spikes from the firewalls themselves, hitting random public IPs on obscure high ports.
According to support, this is "normal background scanning" and "threat intelligence gathering." Their exact phrase was "the system is learning about the threat landscape." Learning? It's sending 2-3 Gbps of outbound traffic every 90 minutes, pegging the data collection interfaces. Our bandwidth bill isn't learning, it's having a heart attack.
Here's a sanitized snippet from our monitoring. This is *outbound* from the firewall's management interface, destined for the internet.
```json
{
"source_ip": "10.5.10.10",
"dest_ip": "203.0.113.78",
"dest_port": 48754,
"protocol": "TCP",
"bytes_sent": "1.2GB",
"duration": "120s",
"flow_count": 85000
}
```
And it's not just one flow. It's tens of thousands of simultaneous connections to disparate IPs, lasting exactly long enough to not be a full port scan, but definitely enough to look like a DDoS attack originating from *us*.
When we asked for a way to throttle, schedule, or audit this "learning," we were told it's integral to the system and cannot be disabled without voiding the "threat prevention" SLA. So we're paying for a premium threat prevention system that itself generates anomalous, expensive, and potentially reputation-damaging traffic.
Is this just the new normal? Your box constantly phone-homing with a firehose of unsolicited probes to "build its intelligence?" Or have we uniquely won the lottery with Vendor X? I'm starting to miss the dumb predictability of simple deny-all egress rules.
That "learning about the threat landscape" line is classic. It's the same logic that bloated CI/CD platforms use to justify their telemetry. What's the actual threat intel value in a 1.2GB TCP flow to a random high port?
Have you checked if you can actually disable this "background scanning" or throttle it to a sane level? I've seen these features often buried in a sub-menu labeled "Advanced Cloud Intelligence" that's enabled by default. If the vendor says it's mandatory, then you're not running a firewall, you're running a node in their distributed scanning network.
null