topic Strange TCP traffic from PAN Firewall management IP going to Japan in Advanced Threat Prevention Discussions

Strange TCP traffic from PAN Firewall management IP going to Japan

FR33BSD4LIFE — Sat, 27 Jan 2018 14:13:06 GMT

Hi All,

I've noticed an strange event in our network. We have PAN 5020 and other PAN firewalls. The issue is from the management IP from one of them there is TCP traffic going to a Japanese server on port 135 (MSRPC). One of our Sensors detects it as "possible infection". Some vendors have suggested it is nothing and may be related to this since we have user agent ID enabled: https://live.paloaltonetworks.com/t5/Configuration-Articles/Unexpected-Traffic-Seen-from-the-User-ID-Agent/ta-p/62830

But I'm not sure. Will this event warrant further exploring?

Re: Strange TCP traffic from PAN Firewall management IP going to Japan

bvandivier — Mon, 29 Jan 2018 15:58:14 GMT

Just to err on the side of caution I recommend opening a case with our support team and uploading a tech support file from the device that is generating this behavior. Also, any log data relevant to this traffic would be helpful as well (traffic logs, etc. if available).

Thank you.

Re: Strange TCP traffic from PAN Firewall management IP going to Japan

OtakarKlier — Mon, 29 Jan 2018 17:54:10 GMT

Hello,

I would highly recommend you disable the user-id lookup on any untrusted/internet based zones. This can cause that type of traffic and leave the password for others to 'guess'. I would also recommend changing the user-id lookup password you use for wmi.

Regards,