To see this working, head to your live site.

PA firewall sending traffic out on port tcp/3978

Hi everyone

I see traffic from my PA-firewall sending out traffic on port tcp/3978. The specific port is used for communication between Panorama and managed firewalls. I don't have any Panorama server setup on my firewall. Why does it still send traffic on that port and how can I disable it?

/Mario

4 comments

Comments (4)

Reaper

Apr 09, 2023

Are you using cortex data lake (CDL)? That uses that port as well.

Are the connections to the same IP and can you identify it?

Mario

Apr 18, 2023

Replying to

CDL is not enabled. I see application is recognized as paloalto-logging-service. Could it be 'IoT Security Default Profile' in Log Forwarding that has a check for Panorama for all log types? I'm not using IoT. All connections goes to the same IP, 34.90.253.226 (gpccloudservice).

Reaper

Apr 18, 2023

Replying to

Yeah that's CDL, (both the appid and the url). Can you u check panorama from the log forwarding profile? It appears it's trying to send to CDL

Mario

Apr 18, 2023

Replying to

You mean uncheck Panorama for the 'IoT Security Default Profile'? It's read-only so I'm not able to do any changes.

Forum: Forum