topic Re: for what purpose would the management interface use msrpc? in General Topics

for what purpose would the management interface use msrpc?

tommyluke — Thu, 26 Sep 2013 20:05:29 GMT

the mgmt interface on a 3050 is reaching out to a number of internal host over msrpc (tcp/135). i've not been successful in discoving the purpose of this via the admin guide - is anyone else seeing this behavior?

thx,

tommyluke

Re: for what purpose would the management interface use msrpc?

kadak — Thu, 26 Sep 2013 20:47:59 GMT

Hello Tom,

Do you have Agentless UserID configured on your firewall? If so, we need to make sure that we disable Client probing under Device > User Identification > User Mapping > Client probing tab.

Regards,

Kunal Adak

Re: for what purpose would the management interface use msrpc?

tommyluke — Thu, 26 Sep 2013 21:13:17 GMT

Thank you kadak. You are correct, I have agentless userid configured. I imagine that, were I to disable client probing, the msrpc data from the management ip would cease. When you stat that we need to "make sure that we disabled client probing" is that because you have experienced problems with client probing?

best,

tommy

Re: for what purpose would the management interface use msrpc?

kadak — Thu, 26 Sep 2013 21:37:54 GMT

Hello Tom,

What I meant was, we haven't seen any problems/ issues per say - after enabling 'Client Probing' in Agentless setup. It just that we saw un-wanted WMI probes from the User-ID function on port 135.

In fact after further investigation, it looks like the issue has been taken care of in PANOS - 5.0.7 and you can verify that in its release notes by 52967.

Regards,

Kunal Adak.