topic Re: Block NMAP port Scanning from Guest wireless Network in Network Access Control

Block NMAP port Scanning from Guest wireless Network

O.Zang — Mon, 08 Mar 2021 22:49:43 GMT

Hello Team

Please how to Block NMAP port Scanning from Guest wireless Network ?

I have configure Guest wireless. Guest is not able to ping Any ressource But NMAP scanning is working. All Private IP execept ISE, DHCP and DNS is Deny, but NMAP is still able to see others Clients connected

Regards

Zanga

Re: Block NMAP port Scanning from Guest wireless Network

Francesco Molino — Tue, 09 Mar 2021 03:21:52 GMT

The guest is going through a FW? How you wanted to block the nmap for guests? Were you thinking using a simple ACL or using a next-gen FW (IPS and/or blocking based on application detection)?

By ACL, you won’t be able to block it without blocking legitimate traffic. The 2nd option will be the way to go.

Re: Block NMAP port Scanning from Guest wireless Network

O.Zang — Tue, 09 Mar 2021 06:04:05 GMT

Thank for your response Francesco.

The wireless Guest are not going through an firewall.

I have deny access to all private IP range excempt for ISE, DNS, and DHCP via the WLC Flexconnect ACL.

Ping, and SSH, or Telnet from Putty is not working. But NMAP is still able to scan the Network.

Thanks

Zang

Re: Block NMAP port Scanning from Guest wireless Network

Francesco Molino — Fri, 12 Mar 2021 03:58:56 GMT

Can you share the ACL you’ve implemented?

Re: Block NMAP port Scanning from Guest wireless Network

thomas — Sat, 13 Mar 2021 19:50:20 GMT

This sounds like an ACL issue on the WLC as stated by @Francesco Molino .

Re: Block NMAP port Scanning from Guest wireless Network

seemon — Mon, 18 Sep 2023 10:58:31 GMT

We are using 9800 WLC with DNAC solution and facing the same challenges. Since Guest is open to connect and outsiders is able to see the connected Mac address by nmap scan hence able to bypass portal authenticaiton by spoofing valid connected user mac address.

Cisco is unable to provide any solutions.