Traffic from Palo Alto to a host on port 135

[AbdallaAbdelkhaliq]

I have a case in which i found in the traffic logs of the firewall that in a particular day in a span of 4 hours, palo alto have sent traffic to a host that is on a remote site on port 135.

Traffic source is PA internal "LAN" interface (used as a service route for LDAP), Destination is the Host on the remote site, Port is 135.

Since we have User-ID WMI probing enabled, i have suspected that a user have logged in from this IP and then a user-to-ip mapping entry was generated and then the firewall was trying to query the host directly using WMI, Also the WMI threshold is set to 20 minutes and on the traffic log there is a log every 20 minutes approximatley.

Now am trying to investigate why palo alto sent the traffic to this IP at that day, But the problem is:

1) the host is a linux machine.

2) there is no way that this host can reach our internal network because its blocked from the remote firewall, also there are no logs on Palo Alto for this IP trying to connect to AD server or any internal resource.

3) in the # show log userid log, the subject IP is not showing.

4) from AD server events there is no trace for this IP.

5) user-ID is only enabled on the LAN zone, its not enabled for the zone that the subject IP is coming from.

In user ID configuration we have enabled "Enable session read" option, so am suspecting that this host might connected to a shared folder or a printer in the domain which triggered the user-ip mapping.

I would like to know how palo alto is reading the session logs from Active Directory or any windows server, and if there is a way to get these logs to invistigate why palo alto was trying to send traffic to this IP on that day even though its out of its user-ID scope.