strange connection from PA - help me please

[_slv_]

Hello

Today I recognised that one of my security policy droppping trafiic from IP 192.168.1.1 adddress from one of my subinterfaces to IP adersses to port 135 from other subnets.

I'm using CaptivePortal but not in that zone where is 192.168.1.1, I'm using AD integration but with agents not on 192.168.1.1.

How to investigate what PAN process is doing that? Please give me some tips how to troubleshoot it.

With regards

SLawek

[kdd]

Hi slv,

port 135 is netbios please look whether netbios is allowed in the rule Lan_A....

Cheers Klaus

[_slv_]

netbios isn't allowed in rules from Lan_A, 192.168.1.1 is a gateway in Lan_A. I have routing between my local networks so it couldn't be a traffic from other LAN network (I think).

Have You any new sugestions?

Regards

SLawek

[kdd]

Hi slv,

this paket isn't allowed by the rule "Lan_A - blokowanie". If you want the data to go through then there should be a rule to allow this traffic.

Port 135 belongs to MSRPC  (Netbios 137-139) . Let me know how ends.

Regards Klaus

[_slv_]

Hi kdd

I know that netbios isn't alloved - this is my intention. I'm looking for source of this traffic.

Gateway 192.168.1.1 in my opinion shouldn't generate such traffic (MSRPC). How to find real source of this traffic?

Any idea?

With regrds

SLawek

[prb]

Do you have user-identification enabled on the zone?

[_slv_]

Yes I have. I'm using user identyfiaction by agents on AD controller installed.

Regards

SLawek

[pulukas]

Do you have any nat interface for this zone?

If so, check the nat logs screening by this port.

[prb]

Connected to the 192.168.1.1 interface?

If it is connecting to a different interface, you can uncheck user-identification from the zone in question.

[kdd]

Hi slv,

i don't know if this is still an issue for you if so please check the router config for NAT. Maybe this is a reason to let appear the router a source towards to PA.

Regards Klaus