NMAP scan strange results

[kmigmar805]

Hello Experts!

I apologize if I am asking too simple question.

I am puzzled with the online nmap remote scan result from our Cisco router. It shows as following:

Not shown: 4996 closed ports

PORT STATE SERVICE

25/tcp filtered smtp

1720/tcp filtered H.323/Q.931

2002/tcp open globe

4002/tcp open mlchat-proxy

However, none of these ports are open on the configuration. Is it some kind of port spoofing intelligent feature of Cisco IOS firewall?

Or does it indicate a major misconfiguration? Currently, ntp, domain and www ports are open on the router.

Please advice.

Thank you very much

[Anu M Chacko]

Hi Ken,

Those ports are open on the Router. I suggest you block these ports using access-lists on the outside interface of the router.

Hope this helps!

Regards,

Anu

P.S. Please mark this question as resolved if it has been answered. Do rate helpful posts. Thanks!