Random UDP 137 to Public IP's after connecting global protect

Reply
Highlighted
L0 Member

Random UDP 137 to Public IP's after connecting global protect

After installing and connecting to Global Protect, FW policy logs are showing large amounts of UDP 137 getting blocking from Global Protect clients going to many random Public IP's.  Any idea what would cause this?  Public IP's have been MS, AWS, Google owned.

Highlighted
L0 Member

A little more information:

 

This only seems to happen when global protect client is active, and doesn't happen on all clients.

 

The UDP 137 traffic is Net Bios Name Query (Appears to be reverse lookup)

 

Name query NBSTAT *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> to random Public IP's

 

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!