Nmap open port

dc93ra — Tue, 19 Mar 2024 08:01:48 GMT

I find myself confused regarding the following case: when running a scan with nmap on an IP address that was previously on my access list, nmap indicates that the ports are still open.

C:\Program Files (x86)\Nmap>.\nmap.exe xxx.xxx.xxx.xx -p 22,3389,5900,1433,3306,21,110,143,23,6667,1025,548,143,23,667,1025,548,445,139,135,1026
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-19 08:50 Hora estßndar romance
WARNING: Duplicate port number(s) specified. Are you alert enough to be using Nmap? Have some coffee or Jolt(tm).
Nmap scan report for xxx.xxx.xxx.xx
Host is up (0.056s latency).

PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
110/tcp open pop3
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
143/tcp open imap
445/tcp filtered microsoft-ds
548/tcp open afp
667/tcp open disclose
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1433/tcp open ms-sql-s
3306/tcp open mysql
3389/tcp open ms-wbt-server
5900/tcp open vnc
6667/tcp open irc

Nmap done: 1 IP address (1 host up) scanned in 2.92 seconds

Despite having removed the object and all applicable policies, the result still shows that the ports are open.

When I check the traffic, I see that all connection attempts are rejected, as the policies I have set for access control are as follows:

Is there any solution to this problem?

Thank you very much for your help.

Re: Nmap open port

JayGolf — Wed, 20 Mar 2024 19:07:11 GMT

Hi @dc93ra ,

When you run nmap from your host to the target server, does that traffic go through the firewall? Can you verify that the fiirewall is in fact in-line with the nmap to destination server? Without knowing much of your environment, could it be that you are running nmap directly to the server without traversing the firewall? I would check the target server to see if it is listening on the ports that is shown through nmap.

topic Re: Nmap open port in Next-Generation Firewall Discussions

Nmap open port

Re: Nmap open port