topic Re: strange connection from PA - help me please in General Topics

strange connection from PA - help me please

_slv_ — Wed, 26 Feb 2014 13:50:39 GMT

Hello

Today I recognised that one of my security policy droppping trafiic from IP 192.168.1.1 adddress from one of my subinterfaces to IP adersses to port 135 from other subnets.

I'm using CaptivePortal but not in that zone where is 192.168.1.1, I'm using AD integration but with agents not on 192.168.1.1.

How to investigate what PAN process is doing that? Please give me some tips how to troubleshoot it.

With regards

SLawek

Re: strange connection from PA - help me please

kdd — Wed, 26 Feb 2014 14:00:21 GMT

Hi slv,

port 135 is netbios please look whether netbios is allowed in the rule Lan_A....

Cheers Klaus

Re: strange connection from PA - help me please

_slv_ — Thu, 27 Feb 2014 17:49:06 GMT

netbios isn't allowed in rules from Lan_A, 192.168.1.1 is a gateway in Lan_A. I have routing between my local networks so it couldn't be a traffic from other LAN network (I think).

Have You any new sugestions?

Regards

SLawek

Re: strange connection from PA - help me please

kdd — Fri, 28 Feb 2014 08:33:57 GMT

Hi slv,

this paket isn't allowed by the rule "Lan_A - blokowanie". If you want the data to go through then there should be a rule to allow this traffic.

Port 135 belongs to MSRPC (Netbios 137-139) . Let me know how ends.

Regards Klaus

Re: strange connection from PA - help me please

_slv_ — Sun, 02 Mar 2014 17:01:28 GMT

Hi kdd

I know that netbios isn't alloved - this is my intention. I'm looking for source of this traffic.

Gateway 192.168.1.1 in my opinion shouldn't generate such traffic (MSRPC). How to find real source of this traffic?

Any idea?

With regrds

SLawek

Re: strange connection from PA - help me please

prb — Wed, 05 Mar 2014 22:19:10 GMT

Do you have user-identification enabled on the zone?

Re: strange connection from PA - help me please

_slv_ — Thu, 06 Mar 2014 08:43:04 GMT

Yes I have. I'm using user identyfiaction by agents on AD controller installed.

Regards

SLawek

Re: strange connection from PA - help me please

pulukas — Thu, 06 Mar 2014 20:54:35 GMT

Do you have any nat interface for this zone?

If so, check the nat logs screening by this port.

Re: strange connection from PA - help me please

prb — Thu, 06 Mar 2014 21:09:26 GMT

Connected to the 192.168.1.1 interface?

If it is connecting to a different interface, you can uncheck user-identification from the zone in question.

Re: strange connection from PA - help me please

kdd — Mon, 10 Mar 2014 09:16:30 GMT

Hi slv,

i don't know if this is still an issue for you if so please check the router config for NAT. Maybe this is a reason to let appear the router a source towards to PA.

Regards Klaus