CSM listening on non-configured ports

[hussainmo]

Hi,

I was testing the CSM for deployment in our SCZ with our security team. During the testing we did a port scan on a vserver on port 80 and what we found out was that the same VIP was also responding on port 25 and 143. Can someone has an idea why would that be the case and if there was a way of fixing this behaviour.

I am attaching the port scan testing report to the post.

Thanks,

Murtaza

[Gilles Dufour]

we'll need the csm config to answer your question.

The first idea is that you have another vserver which is not specific to tcp port 80 and the CSM uses this vserver to forward the traffic.

But we can only confirm with the csm config.

Gilles.

[hussainmo]

Hello,

This is the config.

Thanks,

Murtaza

Router#sh run mod 1

Building configuration...

Current configuration : 716 bytes

module ContentSwitchingModule 1

variable REAL_SLOW_START_ENABLE 2

variable ROUTE_UNKNOWN_FLOW_PKTS 1

!

ft group 42 vlan 402

priority 200 alt 100

preempt

!

vlan 202 server

ip address 192.168.202.3 255.255.255.0

route 0.0.0.0 0.0.0.0 gateway 192.168.202.1

alias 192.168.202.4 255.255.255.0

!

natpool TEST_NAT 192.168.202.250 192.168.202.250 netmask 255.255.255.0

!

probe TEST tcp

interval 15

retries 2

failed 30

open 2

!

real TEST123

address 192.168.202.101

inservice

!

serverfarm TEST

nat server

nat client TEST_NAT

real name TEST123 80

inservice

probe TEST

!

vserver TEST

virtual 192.168.202.250 tcp www

serverfarm TEST

persistent rebalance

inservice

!

end

[Gilles Dufour · Accepted solution]

I tested your config in the lab and there was no response on port 25 and 143.

Are you sure this is the full config ?

Do you have a sniffer trace of the test ?

[capture the portchannel]

Gilles.

[hussainmo]

Hello,

The config is complete but I don't have a sniffer trace. If you can't see the issue in the lab than it might have been a false alarm on the tool.

Many thanks for your help.

-Murtaza