Allow domain services through PAN 2050

[UncleRico]

I am trying to allow windows active directory services (2008 domain) through the firewall, in between zones.  I have created my policy to allow the following applications:

active-directory

ms-ds-smb

msrpc

netbios-ss

dns

ms-win-dns

ms-wins

netbios-dg

ms-netlogon

I have created rules for bi-directional access.

I am unable to join a server to the domain however.  I ran a packet capture and was seeing netbios traffic being dropped (UDP 137) but I have allowed several app-id applications that allow this protocol.

Any ideas?

Thanks!

[mharding · Accepted solution]

Do you have any security profiles enabled? (I've noticed that joining a computer to the domain sets of the IPS/IDS if the profile is restrictive.)

Do you have any service/ports defined in the security policy? I've left mine to any because AD uses some many different ephemeral ports.

Edit: I checked my rule, and these are all the apps I have allowed for AD:

active-directory

dns

icmp

kerberos

ldap

ms-ds-smb

ms-netlogon

msrpc

netbios-dg

netbios-ss

ntp

ping

rpc

Message was edited by: Matthew Harding

[UncleRico]

Thanks!  It looks like adding kerberos, rpc, and ldap seemed to do the trick.