Windows file replication

[Ttiller]

Just updated my PA 200's to version 7.1.0. Have two sites, both using the 200 in a virtual wire deployment. The windows file replication between the two sites (Windows 2012R2) quit working after the software update. Using security profiles so not sure if URL filtering or another security profile is casuing the problem. Or maybe a recent dynamic update (antivirus, app. and threats) is the problem.   Any suggestions before I contact support for help? Thanks in advance.

[BPry]

Do you see anything in the logs that point towards the traffic being labled as a threat or running into a policy deny. That would be the first place to look. 

[Ttiller]

I see in the logs a threat (type - vulnerability) for Microsoft RPC Endpoint mapper using the msrpc application going to port 135 (action - alert). This is what Miscrosoft uses, with randonly assigned ports above 1024, for replication across the WAN. I'm using the default vulnerability protection security profile and it shows read only when I try to edit it. So would I clone this default profile and then edit the clone? If so, would I create a new rule of some sort or add an exception of some type? Thanks

[OtakarKlier]

Hello,

Action 'alert' should not stop traffic fflowing. Check the traffic logs and see why it is getting denied. If you are using the default vulnerability setttings, they should not block this traffic.

My guess would be an application is not enabled on the ruleset and blocking the traffic that way.

Hope this helps.

Regards,

[Ttiller]

Thanks for the info. I guess I'm going to go ahead and go to the latest software version (7.1.6), retry it, then if it still is a problem, disable the default vulnerability protection. Test again and then try to figure out how to change the default to solve the issue. I also noticed that my Symantec client on that server is also no longer communicating back to this site as well. So it looks like it might be time to get tech support involved. Thanks again.

[santonic]

I would suggest checking all (traffic, threat, url...) log files first for blocked events. Because turning off security profiles is not a solution.

[Ttiller]

It would be only to make sure I'm on the right path to the problem. Again, I plan on calling support before this goes too far. Thanks

[Ttiller]

UPDATE: After update of software all traffic and apps working properly. Maybe the reboot after the update cleared the issue. Thanks for all the responses.

[Ttiller · Accepted solution]

Solution:

Had more than one issue going on. But the problem on my Symantec  Client (ver. 14) not communicating with the remote server turned out to be the App and threat software version 650. Once I rolled it back to 648 all was well. And it stands to reason, since the version 14 just came out. Servers me right for deploying so quickly. Thanks to Dante for all his help.

[santonic]

Hmm, I wouldn't be satisfied with this solution. You need to have all your signatures up to date for PA to do its function of protecting your network properly.

If it was some newly released threat (IPS, AV..) signature causing issues it's either a genuine threat or false positive. In first case you have to be aware of it in second case you need to make exception and keep on updating signatures.

If it was app signature causing issue you either have an application you aren't aware of in your network or there is some broken applicaion signature. Both situations can be dealt with by fine tunning your security policy.