topic Re: User-ID Agent „established a connection to suspicious IP ...“ in General Topics https://live.paloaltonetworks.com/t5/general-topics/user-id-agent-established-a-connection-to-suspicious-ip/m-p/10419#M7677 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>do you use WMI probing and did you activate user-id on your external zone? Maybe you should read this KB: <A href="https://live.paloaltonetworks.com/docs/DOC-8125">Customer advisory: Security Impact of User-ID Misconfiguration</A></P><P></P><P>If you activate user id on your external zone the user id agent doesn't know the user for the public IPs and tries to learn the user via wmi probing. </P></BODY></HTML> Tue, 21 Apr 2015 10:16:56 GMT Wenar 2015-04-21T10:16:56Z User-ID Agent „established a connection to suspicious IP ...“ https://live.paloaltonetworks.com/t5/general-topics/user-id-agent-established-a-connection-to-suspicious-ip/m-p/10418#M7676 <HTML><HEAD></HEAD><BODY><P>Hi everybody,</P><P></P><P></P><P>does everyone have this situation on your PA-FW on the ports 137, 139 and 445 with country's: CN, US, MY, IN ...</P><P>We have a lot of outgoing traffic with this situation and find out, that the PaloAlto "User-ID Agent" is the causer.</P><P></P><P></P><P>A lot of the external (outside) addresses are in case of "WebBot" - very curiosity.</P></BODY></HTML> Tue, 21 Apr 2015 09:51:07 GMT https://live.paloaltonetworks.com/t5/general-topics/user-id-agent-established-a-connection-to-suspicious-ip/m-p/10418#M7676 Lindeverlag 2015-04-21T09:51:07Z Re: User-ID Agent „established a connection to suspicious IP ...“ https://live.paloaltonetworks.com/t5/general-topics/user-id-agent-established-a-connection-to-suspicious-ip/m-p/10419#M7677 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>do you use WMI probing and did you activate user-id on your external zone? Maybe you should read this KB: <A href="https://live.paloaltonetworks.com/docs/DOC-8125">Customer advisory: Security Impact of User-ID Misconfiguration</A></P><P></P><P>If you activate user id on your external zone the user id agent doesn't know the user for the public IPs and tries to learn the user via wmi probing. </P></BODY></HTML> Tue, 21 Apr 2015 10:16:56 GMT https://live.paloaltonetworks.com/t5/general-topics/user-id-agent-established-a-connection-to-suspicious-ip/m-p/10419#M7677 Wenar 2015-04-21T10:16:56Z