traceroute application allows tcp port 80

[nextgenhappines]

Hi,

Received a call from a client said their external scanner shows their servers behind the firewall allows tcp port 80 connections and able to passive finger those servers, but there is no firewall rule permit tcp port 80 to those servers.  Digging it deeper, found one of the rule allows traceroute application with application default which allows icmp/dynamic, tcp/80, udp 33434-33534. 

I can understand icmp/dynamic and udp 33343-33534 portion, but why allow tcp port 80??

The interesting parts are,

1.  You can't use the traceroute as application and define your own services, since services in 5.0 does not support icmp.

2.  In most *nix system, you can customize traceroute to use any tcp/udp ports for probe, but why only permit tcp port 80?  Why not all tcp ports and udp ports?

How are other client dealing with this issue?  What other applications have this similar issues that we have not discovery?

Thanks,

E

[ukhapre]

Hello, I hope port 80 is added to allow web based traceroute e.g. Free online network tools - traceroute, nslookup, dig, whois lookup, ping - IPv6

Setting up security rule with service as 'application-default' should restrict allowed traffic with signature+port match only.

[ExclusiveNetworksGermany]

tcptraceroute is sometimes used when icmp and udp is blocked.

Port 80 is open is most environments

http://www.catonmat.net/blog/tcp-traceroute/

The Programm tcptraceroute uses TCP/80 as well

Manual Page - tcptraceroute(1)

Regards

Marco

[nextgenhappines]

ukhapre wrote:

Hello, I hope port 80 is added to allow web based traceroute e.g. Free online network tools - traceroute, nslookup, dig, whois lookup, ping - IPv6
Setting up security rule with service as 'application-default' should restrict allowed traffic with signature+port match only.

Just keep this in mind, the first 8 packets will get pass the firewall until App-ID able identify the application,  that is plenty to perform passive finger printing to servers behind the firewall which may have tcp port 80 listen but you don't want the world to be able to probe it..

[nextgenhappines]

But why limit to only TCP 80?  Why not TCP 443 or any tcp port?   Since PAN firewall only support TCP or UDP as service,  you can't specific the service with the application.  The only way to lock it down is to use application default. 

ExclusiveNetworksGermany wrote:

tcptraceroute is sometimes used when icmp and udp is blocked.
Port 80 is open is most environments

http://www.catonmat.net/blog/tcp-traceroute/

The Programm tcptraceroute uses TCP/80 as well

Manual Page - tcptraceroute(1)


Regards
Marco

[laurence64]

Hi 

I know this is an old post, but I found it as I have some odd traffic coming from an Android device, this was traceroute to the internet on port 80.

A few apps were not working and the inclusion of this in the rule did help to fix one of them, just wanted to add that I found this article from Palo on the subject

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClrNCAS