block tcp ports 21/5060/2000 FMC

GHOZLANE Haroun — Wed, 05 Feb 2025 12:18:39 GMT

Hi Dears,

I’ve encountered an issue with FTD managed via Firepower Management Center (FMC), running the recommended version 7.4.2

Issue Details:

After performing an Nmap scan on the outside interface, we discovered that TCP ports 21, 2000, and 5060 are showing as open.
This behavior persists even though:
- There are no specific ACLs or NAT rules configured to allow these ports.
- We have explicitly created rules to deny these ports, but they still appear open in the scan.

Additional Observations:

This issue is only present on FTD managed via FMC.
On FTD devices managed via FDM (Firepower Device Manager), the same Nmap scan shows these ports as closed as expected.

Re: block tcp ports 21/5060/2000 FMC

Marvin Rhoads — Wed, 05 Feb 2025 13:38:02 GMT

This can be caused by the device's default ALG inspections for ftp, sccp and sip (which use the three respective ports you noted).

It is not actually open ports that potentially allow traffic through the device but rather the inspection process completing the handshake in order to further inspect payload (which in this case doesn't exist).

topic Re: block tcp ports 21/5060/2000 FMC in Network Security

block tcp ports 21/5060/2000 FMC

Issue Details:

Additional Observations:

Re: block tcp ports 21/5060/2000 FMC