topic Need Help on Port Blocking in ASA in Network Security

Need Help on Port Blocking in ASA

engrhaiderabbas — Tue, 12 Mar 2019 02:15:48 GMT

Dear All,

I have configured firewall and allow only port 443 and deny all tcp ports for destination, but when i am scanning from port scanner it shows several tcp ports are enabled.. need your seuggestion and help on it.. how to block these tcp ports..

Early response is required..

Thanks

Need Help on Port Blocking in ASA

Jouni Forss — Tue, 23 Jul 2013 12:11:55 GMT

Hi,

You have not given any configurations to reference or mentioned at all the ports that were open in the scanner.

We would need a bit more information to go on.

- Jouni

Need Help on Port Blocking in ASA

engrhaiderabbas — Tue, 23 Jul 2013 12:25:26 GMT

Below is the configuration..

access-list extended permit tcp any host ip eq https

access-list extended deny ip any any

Need Help on Port Blocking in ASA

Jouni Forss — Tue, 23 Jul 2013 12:33:17 GMT

Hi,

Still don't know the ports that were supposedly open.

Though if that is the ACL you have bound to the "outside" interface on the ASA then it should be blocking the connections through the ASA for everything else other than the TCP/443 for a single destination IP address.

Then there is naturally the ASAs own services and ports on which its listening on.

You can check that with the following command

show asp table socket

Most likely the ports that are open on the ASA are the ones used for management purposes perhaps

Those set with the following commands

telnet

ssh

http

You also have the option to create an ACL that blocks all traffic to the ASA "outside" interface IP address. You can then attach it with "access-group" command

access-group in interface outside control-plane

This would limit the "To the Box" traffic. Though the above mentioned management commands "telnet", "ssh" and "http" would still override this ACL.

- Jouni