Description

135 as a destination port is used for MS-RPC protocol.

https://www.speedguide.net/port.php?port=135


Juniper has an ALG for it:

https://www.juniper.net/documentation/us/en/software/junos/alg/topics/topic-map/security-rpc-alg.html#id-understanding-microsoft-rpc-algs

Symptoms

If "monitor security packet-drop" is used, a drop on a flow for port 135 can be seen with the reason being 135

Solution

Either disable MS-RPC with "set security alg msrpc disable"


Or configure the security policies appropriately to catch the MS-RPC traffic:

https://www.juniper.net/documentation/us/en/software/junos/alg/topics/topic-map/security-rpc-alg.html#id-configuring-the-microsoft-rpc-alg

Modification History

2024-10-28 : Article Created