topic Re: Risky ports in General Topics

Risky ports

SumitB — Fri, 01 Jun 2018 10:44:23 GMT

What are the risky ports we should not allow from user zone (internal network) to external network (internet / external network)? Like we don't allow 21/23 etc, please suggest other ports too.....

Re: Risky ports

santonic — Fri, 01 Jun 2018 11:09:08 GMT

Go the other way, only allow 80, 443 and maybe few others on explicit requests. And implement app policy.

Re: Risky ports

SumitB — Fri, 01 Jun 2018 11:13:35 GMT

I think 80 is also should not be allowed, we used to allow http/https app id instead of ports but what are the most critical ports we should allow anyhow like 21/23.

Re: Risky ports

reaper — Fri, 01 Jun 2018 12:18:10 GMT

in the new age of Next Generation firewalls, ports do not matter as much as they used to

today a lot more protocols and applications use port 80 and 443 where older, more traditional, protocols would use their own port

App-ID will assist tremendously in identifying exactly what is traversing the firewall, versus simply monitoring the ports

each application comes with "application default" ports which will also help to close off 'unusual' ports

So if you create, for example, a rule that allows web-browsing, ssl and DNS and set the service ports to 'application default', only ports 80,443 and 53 will be 'open' for this rule

'threat' wise, ports 80 and 443 pose far more risks than any other ports combined, so leveraging App-ID with content scanning and threat protection would be a more secure route than relying on just ports