topic Re: Windows file replication in General Topics

Windows file replication

Ttiller — Tue, 03 Jan 2017 16:47:44 GMT

Just updated my PA 200's to version 7.1.0. Have two sites, both using the 200 in a virtual wire deployment. The windows file replication between the two sites (Windows 2012R2) quit working after the software update. Using security profiles so not sure if URL filtering or another security profile is casuing the problem. Or maybe a recent dynamic update (antivirus, app. and threats) is the problem. Any suggestions before I contact support for help? Thanks in advance.

Re: Windows file replication

BPry — Tue, 03 Jan 2017 17:06:21 GMT

Do you see anything in the logs that point towards the traffic being labled as a threat or running into a policy deny. That would be the first place to look.

Re: Windows file replication

Ttiller — Tue, 03 Jan 2017 17:26:28 GMT

I see in the logs a threat (type - vulnerability) for Microsoft RPC Endpoint mapper using the msrpc application going to port 135 (action - alert). This is what Miscrosoft uses, with randonly assigned ports above 1024, for replication across the WAN. I'm using the default vulnerability protection security profile and it shows read only when I try to edit it. So would I clone this default profile and then edit the clone? If so, would I create a new rule of some sort or add an exception of some type? Thanks

Re: Windows file replication

OtakarKlier — Tue, 03 Jan 2017 22:52:28 GMT

Hello,

Action 'alert' should not stop traffic fflowing. Check the traffic logs and see why it is getting denied. If you are using the default vulnerability setttings, they should not block this traffic.

My guess would be an application is not enabled on the ruleset and blocking the traffic that way.

Hope this helps.

Regards,

Re: Windows file replication

Ttiller — Wed, 04 Jan 2017 13:39:06 GMT

Thanks for the info. I guess I'm going to go ahead and go to the latest software version (7.1.6), retry it, then if it still is a problem, disable the default vulnerability protection. Test again and then try to figure out how to change the default to solve the issue. I also noticed that my Symantec client on that server is also no longer communicating back to this site as well. So it looks like it might be time to get tech support involved. Thanks again.

Re: Windows file replication

santonic — Wed, 04 Jan 2017 14:03:58 GMT

I would suggest checking all (traffic, threat, url...) log files first for blocked events. Because turning off security profiles is not a solution.

Re: Windows file replication

Ttiller — Wed, 04 Jan 2017 14:06:33 GMT

It would be only to make sure I'm on the right path to the problem. Again, I plan on calling support before this goes too far. Thanks

Re: Windows file replication

Ttiller — Wed, 04 Jan 2017 16:34:35 GMT

UPDATE: After update of software all traffic and apps working properly. Maybe the reboot after the update cleared the issue. Thanks for all the responses.

Re: Windows file replication

Ttiller — Wed, 04 Jan 2017 22:12:38 GMT

Solution:

Had more than one issue going on. But the problem on my Symantec Client (ver. 14) not communicating with the remote server turned out to be the App and threat software version 650. Once I rolled it back to 648 all was well. And it stands to reason, since the version 14 just came out. Servers me right for deploying so quickly. Thanks to Dante for all his help.

Re: Windows file replication

santonic — Thu, 05 Jan 2017 07:04:56 GMT

Hmm, I wouldn't be satisfied with this solution. You need to have all your signatures up to date for PA to do its function of protecting your network properly.

If it was some newly released threat (IPS, AV..) signature causing issues it's either a genuine threat or false positive. In first case you have to be aware of it in second case you need to make exception and keep on updating signatures.

If it was app signature causing issue you either have an application you aren't aware of in your network or there is some broken applicaion signature. Both situations can be dealt with by fine tunning your security policy.