Security

Reply
Frequent Contributor I
Posts: 73
Registered: ‎09-08-2015

Netbios traffic to ClearPass?

Is there any reason domain joined windows clients would be trying to send UDP/137 and UDP/138 traffic to ClearPass?

We've just moved our ClearPass servers behind a firewall and have noticed a lot of this traffic dropped in the logs.

 

Clients are authenticating using PEAP, but in theory would have no way of knowing about ClearPass? Unless it is somehow related to DHCP relay - the L3 gateway for the client subnets has an IP helper configured pointing to ClearPass for DHCP fingerprinting.

Guru Elite
Posts: 19,949
Registered: ‎03-29-2007

Re: Netbios traffic to ClearPass?

The helper address forwards all broadcasts, unless you filter out what it forwards.

Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Validated Reference Design Guides : http://community.arubanetworks.com/t5/Validated-Reference-Design/tkb-p/Aruba-VRDs
Search Airheads
Showing results for 
Search instead for 
Did you mean: