topic Re: UserId Agent stating connections port 135 in General Topics

UserId Agent stating connections port 135

BigPalo — Fri, 18 Sep 2020 07:50:25 GMT

Hi,

We need to know why our UIAs are starting sessions to INTERNET in port 135.

how can we mitigate this flow? WE disblae UIA in INTERNET zone but we still see these sessions.

Here you can see the kind of sessions:

any idea?

Re: UserId Agent stating connections port 135

BPry — Fri, 18 Sep 2020 16:49:04 GMT

@BigPalo

This sounds like you have Client Probing enabled, and if you've verified that User-ID is disabled on the untrust interface you'll also want to go through and verify that it isn't included in your Include Network listing.

Re: UserId Agent stating connections port 135

BigPalo — Fri, 18 Sep 2020 19:16:10 GMT

Thanks for your response Bpry

So, you mean in UIA Agent config to add the LAN network in "incluted list of configured networks", right?

or you mean to disable WMI probing (this could cause impact)

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbkCAC

So we also should disable Probin in PA config? "Go to Device >> User Identification
On the "User Mapping" tab, in the "Palo Alto Networks User ID Agent" pane, view the "Enable Probing" check box. If it is selected, this is a finding.

Re: UserId Agent stating connections port 135

BPry — Sun, 20 Sep 2020 03:51:18 GMT

@BigPalo,

verify that you actually have an include network configured on the agent. Client Probing really isn't a recommended configuration anymore, and you definitely don't want to allow sending those probes externally.