topic RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently. in General Topics

RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently.

Prime — Fri, 05 Jun 2020 13:08:55 GMT

RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently. Getting error “Blocked MS-RPC non compliant version”.

Re: RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently.

Prime — Fri, 05 Jun 2020 19:06:01 GMT

We noticed this issue today. Server is unable to connect to the domain controller from last 3 days.

After changing the inspection configuration for Non compliant MS RPC to accept, we now see one packet allowed and one packet denied with same error.

R80.10

Re: RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently.

Wolfgang — Fri, 05 Jun 2020 19:52:51 GMT

@Prime

did you create recently the new service „TCP_135“ and used them in your policy?

It‘s better to use the default „ALL_DCE_RPC“-service for Microsoft connections on port tcp/135.

Follow DCE-RPC traffic is dropped on High Ports , I think this should help.

Wolfgang

Re: RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently.

Prime — Fri, 05 Jun 2020 22:54:22 GMT

Will the use of a DCE/RPC service will stop SecureXL's ?

Re: RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently.

Chris_Atkinson — Sat, 06 Jun 2020 02:12:09 GMT

Consider the rule placement per sk32578

Re: RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently.

Timothy_Hall — Sat, 06 Jun 2020 02:17:21 GMT

Use of a DCE/RPC service in a rule will stop SecureXL Accept templating but not affect whether or how the traffic can be accelerated. So try to place the rule permitting DCE/RPC as far down as possible in your rule base.

Re: RPC traffic on port 135 getting blocked on Checkpoint firewall intermittently.

Prime — Mon, 08 Jun 2020 08:09:54 GMT

Error:-Blocked MS-RPC non compliant version
we followed SK66605 file in order to resolve the issue.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk66605&partition=Advanced&product=Security

Edited the $FWDIR/lib/table.def file

fw_dcerpc_map_ports = { <135> };
to
fw_dcerpc_map_ports = { };

>>>We disabled the extra rule which was used for per-defined service DCERPC.

>>>Post that pushed the policy, Traffic started to work and able to join the domain.