Re: Microsoft SP1 RPC traffic (Active Directory issues)

[Brian A. Seklecki]

On Thu, 20 Apr 2006, James Mackinnon wrote:

Good day everyone
Recently, I installed SP1 on some domain controllers and ran into an issue
where microsoft changed rpc data with SP1 and firewalls such as microsofts own
ISA server as well as checkpoint have started to randomly block this data.


...look at the pflog(4), correlate hits with the source address of servers 
having problems with the blocks, generate a pf.conf(5) rule to match, and 
move on.

~BAS