- Mark as New
- Subscribe to RSS Feed
- Permalink
06-01-2018 03:43 AM - edited 06-01-2018 03:44 AM
What are the risky ports we should not allow from user zone (internal network) to external network (internet / external network)? Like we don't allow 21/23 etc, please suggest other ports too.....
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-01-2018 04:13 AM
I think 80 is also should not be allowed, we used to allow http/https app id instead of ports but what are the most critical ports we should allow anyhow like 21/23.
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-01-2018 05:18 AM
in the new age of Next Generation firewalls, ports do not matter as much as they used to
today a lot more protocols and applications use port 80 and 443 where older, more traditional, protocols would use their own port
App-ID will assist tremendously in identifying exactly what is traversing the firewall, versus simply monitoring the ports
each application comes with "application default" ports which will also help to close off 'unusual' ports
So if you create, for example, a rule that allows web-browsing, ssl and DNS and set the service ports to 'application default', only ports 80,443 and 53 will be 'open' for this rule
'threat' wise, ports 80 and 443 pose far more risks than any other ports combined, so leveraging App-ID with content scanning and threat protection would be a more secure route than relying on just ports
PANgurus - Strata specialist; config reviews, policy optimization
