Management inteface send packet port 137 to broadcast public IP

[Register_Security]

Hi all,

I monitor traffic on management interface of 3020, I have seen so many packet from management IP to an broadcast IP

Aug 23 14:49:24	192.168.1.15:35889	203.77.255.255:137	UDP
Aug 23 14:49:24	192.168.1.15:52601	203.77.255.255:137	UDP

I try to stop all service on management interface but it is not affect.

Please help me to stop these packet.

Thanks,

[mikand]

Do you have userid setup, that is if your PA-3020 is trying to reach some AD machine?

[mbutt]

Do you have user id enabled on public zone.

Here is a doc which explains why you might see alot of traffic to random public ip address with port 137.

https://live.paloaltonetworks.com/docs/DOC-4705

Let us know if this helped you resolve your issue.

Thanks

Numan

[sjamaluddin]

Have you made this PAN firewall part of an AD domain? UDP port 137 appears to be some NETBIOS traffic and its unlikely that the management port will be spewing that out unless this PA has been included as a domain device.

[Register_Security · Accepted solution]

Thanks for all reply.

I found and fixed the problem.

The reason is PAN auto enable "Microsoft Active Directory" my domain.