08-03-2018 11:50 AM
I am new to the world of PA and next gen firewalls and took some online training. I discovered that in the Traffic Proccessing phase before App ID gets applied in the Security Policy that the session is already allowed to start if the layer 4 ports are allowed in the policy. This makes me wonder if I were to run a port scan on my public address or telnet to a specific port that I would still be able to find out if its open using those same old tricks. In my mind since all the telnet trick does is send a SYN packet to the IP address I'm troubleshooting than the PA should still be able to send back a SYN ACK for the port I'm checking thus letting me know if its open or not. I understand that the point of App ID is to prevent hackers from using any application they want over a default port (e.g using http over port 22) but in theory if the session is allowed to start before App ID kicks in then I can still telnet to port 80 to see if its open just like I always have. Is this true or am I way out in deep space nine?
01-31-2021 03:11 PM
Hello,
I think For the syn-scan (with no Threat prevention profile) or telnet you can discover open ports, in traffic logs it should be appear as "incomplete". In session logs also it should be on "discard" state.
**Against scanning zone-protection profiles has good prevetion options.
01-31-2021 03:37 PM - edited 01-31-2021 03:38 PM
@MarioMarquez your assumption is correct
you can decrease your external footprint by using application-default in all of your rule so that only the ports you actually expose to the outside are open but the ports that are open are open so can be connected to via telnet
to protect from portscans you should enable a zone protection profile with host sweep and port scan set to block so that scanners will be detected and blocked after a number of suspicious connections
02-01-2021 10:59 PM - edited 02-04-2021 12:24 AM
This chapter teaches how to scan the operating system for viruses and how to stop DDoS attacks. Although applications such as Zombie Zapper are not foolproof, they can still help you prepare against such attacks prepaidcardstatus
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
