topic Re: Unnecessary traffic on WMI Port in General Topics

Unnecessary traffic on WMI Port

Mohammed_Yasin — Wed, 11 Mar 2020 11:51:54 GMT

Management interface generating unnecessary traffic on WMI Port... what could be reason??

Appliance: PA-5020

PAN-OS:8.1.11

SutareMayur — Wed, 11 Mar 2020 13:34:31 GMT

Hi @Mohammed_Yasin Do you have user-id agent configured in your environment ?

Mayur

Mohammed_Yasin — Wed, 11 Mar 2020 14:06:45 GMT

Thanks for reply.... Yes, User-ID has configured

SutareMayur — Wed, 11 Mar 2020 16:24:17 GMT

@Mohammed_YasinSo here suspecting below points -

1. WMI Probing is enabled on user-id agent.

2. User Identification is enabled on untrust zone.

Can you please cross check these settings ?

Mayur

Mohammed_Yasin — Thu, 12 Mar 2020 05:41:56 GMT

Let me brief, the Unnecessary traffic over management interface,

In Perimeter PA 5020

In Data Center Cisco ASA 5xxx

In the Cisco firewall logs, the traffic sources are PA Management IP and Destination is Cisco management IP and attempt on port 135.

Attachment of logs