135 Dropped by Rule 996

[ErrolDC2]

I am running a discovery tool against a system that has the Checkpoint SecuRemote VPN client installed. This client has policies that I assume are pushed down to it from a master server.
When i run our discovery against this system, the first couple of packets to port 135 will be accepted. After that, it will drop any other packets.
From research, I've determined that some higher inspection is being done and that the firewall is dropping the packet because the specific DCE RPC service is not recognized by the firewall.

http://209.85.173.104/search?q=cach...tml&hl=en&ct=clnk&cd=1&gl=us&client=firefox-a

Our discovery is simply WMI based - for example - using wbemtest to test from system-a to system-b (system b running the vpn client). We can overcome this by un-checking the related protocol from the NIC, but obviously this is not what we want full time.

Thank in advance,

Errol Neal

 

[watchguardmonkey]

The RPC will be denied by smart defense as it will think this is an attack, the rpc can be switched off or re-configured to a higher threshold in the smart defense dashboard, or simply a add a rule to he FW allowing 135 DCE RPC to and from the required IP's, don't forget to amend, remove any changes to the smart defensr/FW ruleset when testing is complete.

wgm