> Source: [sk164593](https://support.checkpoint.com/results/sk/sk164593)

# sk164593 - Data connection (high ports) for DCE-RPC traffic dropped by cleanup rule

| Property | Value |
|----------|-------|
| Solution ID | sk164593 |
| Date Created | 2020-01-12 |
| Last Modified | 2022-02-17 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Data connection (high ports) for DCERPC traffic is dropped by the cleanup rule.
* Traffic capture shows RemoteCreateInstance responses which are encrypted.

## Cause

In case of DCOM traffic, the data connection is often encrypted (Especially if Windows 10 is communicating with another Windows 10 machine).

For such cases, where the data connection is encrypted, the *ALL_DCE_RPC* service will not open the data connection (high ports).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content