Security

Hi, I've just been looking at traffic logs for our clearpass server and noticed something odd. Its trying to RDP out to the private address range 172.16.x.x, cycling through each IP address one at a time. Is this normal behaviour?

ClearPass does not use the remote desktop protocol.

Do you know what it would be doing on port 3389?

Are you doing any subnet scanning in ClearPass? It could be nmap attempting to probe hosts to profile them.

Nmap profiling appears to be off currently.

Best to work with TAC then.