Update from Meraki support Your concern is valid, and the situation calls for a clear understanding of how to interpret and handle these logs. If you're seeing an "AnyConnect VPN connection established" log entry for a known malicious IP, it can indeed be alarming, even if no credentials were used or access was gained. The "connection established" log might only indicate that the malicious actor initiated a VPN handshake, not that they successfully authenticated. The actor would need valid credentials (username and password or certificate) to fully establish a session and access resources. Also some systems log the handshake as "established" regardless of authentication success. If this IP is flagged for malicious activities like HTTP scanning and SSH brute force, it suggests automated probing or attacks. The IP scanning your public-facing WAN is attempting to connect via AnyConnect but may not have succeeded beyond the initial handshake. So meaning A "connection established" log entry typically indicates that a TCP or UDP handshake occurred. This doesn't necessarily mean a user authenticated or gained access to sensitive resources—it might simply mean that a connection attempt was technically successful. False positives can occur in systems that have broad detection rules or rely on incomplete data to flag activities. For example: IDS/IPS or firewall logs might show traffic that matches suspicious patterns but isn't actually malicious. An endpoint or system might flag a benign but unusual behavior as rogue.
... View more
