Unnecessary traffic on WMI Port

[Mohammed_Yasin]

Management interface generating unnecessary traffic on WMI Port... what could be reason??

Appliance: PA-5020

PAN-OS:8.1.11

[SutareMayur]

Hi @Mohammed_Yasin  Do you have user-id agent configured in your environment ?

Mayur

[Mohammed_Yasin]

Thanks for reply.... Yes, User-ID has configured

[SutareMayur]

@Mohammed_YasinSo here suspecting  below points -

1. WMI Probing is enabled on user-id agent.

2. User Identification is enabled on untrust zone.

Can you please cross check these settings ?

Mayur

[Mohammed_Yasin]

Let me brief, the Unnecessary traffic over management interface,

In Perimeter PA 5020

In Data Center Cisco ASA 5xxx

In the Cisco firewall logs, the traffic sources are PA Management IP and Destination is Cisco management IP and attempt on port 135.

Attachment of logs