Which ports are being used by PAN?

[rps]

When you for example set an url-category into "continue" the continue response-page is issued through tcp 6079.

However there is no need to setup a policy for this traffic since the PAN will handle this on its own.

But when I enabled captive portal with ntlm-auth I noticed blocked traffic towards the L3 interface of the PAN at tcp 6080 and 7080.

What are these ports used for and does there exist a portlist for which ports one might need to create policies for to avoid denied/dropped packets (which I assume shouldnt be denied/dropped)?

[rmonvon]

Hi,

Port 6080 is used for captive-portal authentication, this is a web page prompting the unknown user to login via username/pwd.

Port 7080 is used for NTLM authentication, this is simulating a Windows server authenticating the unknown user to login via NTLM username/pwd.

The PAN device uses these ports to decide which authentication method to use to challenge the user.  Some addt'l services may also be in used depending on the configuration:

for mgmt: HTTP, HTTPS, telnet, ssh, ping, SNMP

PAN agent: a configurable TCP port like 3011

TS Agent port

SSL, IPsec ports for VPN

[gsamuels]

  Here are the services using the open ports you have indicated.

6080-6081 - Captive portal, Captive portal redirect and URL override page

6082- Captive portal  Captive portal redirect with certificate.