block tcp ports 21/5060/2000 FMC

[haroungh]

Hi Dears,

I’ve encountered an issue with FTD  managed via Firepower Management Center (FMC), running the recommended version 7.4.2

Issue Details:

• After performing an Nmap scan on the outside interface, we discovered that TCP ports 21, 2000, and 5060 are showing as open.
• This behavior persists even though:
  • There are no specific ACLs or NAT rules configured to allow these ports.
  • We have explicitly created rules to deny these ports, but they still appear open in the scan.

Additional Observations:

• This issue is only present on FTD  managed via FMC.
• On FTD devices managed via FDM (Firepower Device Manager), the same Nmap scan shows these ports as closed as expected.

[Marvin Rhoads]

This can be caused by the device's default ALG inspections for ftp, sccp and sip (which use the three respective ports you noted).

It is not actually open ports that potentially allow traffic through the device but rather the inspection process completing the handshake in order to further inspect payload (which in this case doesn't exist).