Technical Tip: DCE/RPC Sessions helper will not create pin-hole sessions

[adhawan]

Description	This article describes that DCE/RPC Sessions helper on TCP 135 is not helping to create pinhole sessions after the binding messages.
Scope	FortiGate.
Solution	DCE/RPC Sessions helper on TCP 135 is not helping to create pinhole sessions after the binding messages. Based on the below PCAP: The value for Packet privacy in the DCERPC packet is set to 6. (RPC_C_AUTHN_LEVEL_PKT_PRIVACY). Related document: https://docs.microsoft.com/en-us/windows/win32/com/com-authentication-level-constants It means the port info in the negotiation process has been encrypted. So FGT DCE/RPC helper can never know this port and open a pinhole for it. This authentication level forbids any other hosts between the client and server to get the DCERPC packet's data. So, it is suggested to open the ports TCP/49152-65535 on the FortiGate policy or change the Packet privacy on the client side to anything under 6 in the DCE/RPC packet.