for what purpose would the management interface use msrpc?

[tommyluke]

the mgmt interface on a 3050 is reaching out to a number of internal host over msrpc (tcp/135). i've not been successful in discoving the purpose of this via the admin guide - is anyone else seeing this behavior?

thx,

tommyluke

[kadak]

Hello Tom,

Do you have Agentless UserID configured on your firewall? If so, we need to make sure that we disable Client probing under Device > User Identification > User Mapping > Client probing tab.

Regards,

Kunal Adak

[tommyluke]

Thank you kadak. You are correct, I have agentless userid configured. I imagine that, were I to disable client probing, the msrpc data from the management ip would cease. When you stat that we need to "make sure that we disabled client probing" is that because you have experienced problems with client probing?

best,

tommy

[kadak · Accepted solution]

Hello Tom,

What I meant was, we haven't seen any problems/ issues per say - after enabling 'Client Probing' in Agentless setup.  It just that we saw un-wanted WMI probes from the User-ID function on port 135.

In fact after further investigation, it looks like the issue has been taken care of in PANOS - 5.0.7  and you can verify that in its release notes by 52967.

Regards,

Kunal Adak.