Closing Unused ports on my ASA

[tech_king]

I just ran a portscan on my asa firewall and noticed that the ports listed below are open on my outside interface. My problem is that I am not using any of these ports and have not firewall rules permitting them. Any ideas on how to close them?

2000/tcp open   cisco-sccp
5060/tcp open   sip
8008/tcp open   http
8080/tcp open   http-proxy

[Aditya Ganjoo]

Hi,

You can configure an access list on the outside interface of the ASA denying traffic on these ports from any source.

For example:

access-list out deny tcp any any eq 2000

access-list out deny tcp any any eq 5060

In case you need services for any other host you need to create a permit statement above these deny statements.

Regards,

Aditya

Please rate helpful and mark correct answers

[johnd2310]

Hi,

What asa firewall software version are you running? 

Usually, you deny traffic destined to the firewall by creating an access-list and applying the access list using the access-group and control-plane keyword

e.g.

access-list HOST_FIREWALL extended deny ip any any log

access-group HOST_FIREWALL in interface OUTSIDE control-plane

if you have any services running on the firewall like VPN, then, you will need to allow the appropriate ports in your access-list.

Thanks

John

[Marvin Rhoads]

Make sure you don't have phone proxy configured. Those ports would be used by something like that.

Also check that is is not a false positive from your scanning tool. If you go into the ASA cli and type:

show asp table socket

..you will get a listing of the open ports (both listening and established connections). On mine I only see ssh and ssl (tcp/22 and tcp/443) open.

[Karsten Iwen · Accepted solution]

Are you running your tests from within a firewalled network? Repeat the test from a PC that is directly connected to the internet without any additional firewall. The results can vary.