topic Re: Allow domain services through PAN 2050 in General Topics

Allow domain services through PAN 2050

UncleRico — Fri, 19 Oct 2012 17:19:44 GMT

I am trying to allow windows active directory services (2008 domain) through the firewall, in between zones. I have created my policy to allow the following applications:

active-directory

ms-ds-smb

msrpc

netbios-ss

dns

ms-win-dns

ms-wins

netbios-dg

ms-netlogon

I have created rules for bi-directional access.

I am unable to join a server to the domain however. I ran a packet capture and was seeing netbios traffic being dropped (UDP 137) but I have allowed several app-id applications that allow this protocol.

Any ideas?

Thanks!

Re: Allow domain services through PAN 2050

mharding — Fri, 19 Oct 2012 17:51:39 GMT

Do you have any security profiles enabled? (I've noticed that joining a computer to the domain sets of the IPS/IDS if the profile is restrictive.)

Do you have any service/ports defined in the security policy? I've left mine to any because AD uses some many different ephemeral ports.

Edit: I checked my rule, and these are all the apps I have allowed for AD:

active-directory

dns

icmp

kerberos

ldap

ms-ds-smb

ms-netlogon

msrpc

netbios-dg

netbios-ss

ntp

ping

rpc

Message was edited by: Matthew Harding

Re: Allow domain services through PAN 2050

UncleRico — Fri, 19 Oct 2012 20:43:20 GMT

Thanks! It looks like adding kerberos, rpc, and ldap seemed to do the trick.