Hello everybody,
I have aWindowsServer2008 R2Enterprise-Enterprisewith
TMG 2010,
On the monitoralerts,accused ablockingconnectionsper minutefrom a
Determinedmicro, I analyzed thelogsand sawthat there aremany blocksofbroadcast
Thismicrocomingport
5355.
TheTMGby defaultblocks thebroadcast, howeverwhat makes mepuzzledis the amount ofblockingcoming this
specificmicro.
I analyzedthe logsofantivirusand nothing wasdetected,themachine isinstalledSymantecendopoint.
I would liketheopinion of colleagues, I am postingthefollowingproblem:
Cliente IP Destination ip Destination Port
192.168.0.130 224.0.0.252 5355 Link-local multicast name resolution Denied
192.168.0.130 224.0.0.252 5355 Link-local multicast name resolution Denied
192.168.0.130 224.0.0.252 5355 Link-local multicast name resolution Denied
FWX_E_BROADCAST_PACKET_DROPPED
Denied Connection | SRVTMG 22/01/2013 11:31:30 |
Log type:Firewall service | |
Status:A broadcast packet was dropped by the Forefront TMG policy. | |
Rule:None - see Result Code | |
Source:Internal (192.168.0.130:64558) | |
Destination:External (224.0.0.252:5355 |