Port Scans & Telnets on a PA running 8.0

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
MarioMarquez
L3 Networker

Port Scans & Telnets on a PA running 8.0

I am new to the world of PA and next gen firewalls and took some online training.  I discovered that in the Traffic Proccessing phase before App ID gets applied in the Security Policy that the session is already allowed to start if the layer 4 ports are allowed in the policy.  This makes me wonder if I were to run a port scan on my public address or telnet to a specific port that I would still be able to find out if its open using those same old tricks.  In my mind since all the telnet trick does is send a SYN packet to the IP address I'm troubleshooting than the PA should still be able to send back a SYN ACK for the port I'm checking thus letting me know if its open or not.  I understand that the point of App ID is to prevent hackers from using any application they want over a default port (e.g using http over port 22) but in theory if the session is allowed to start before App ID kicks in then I can still telnet to port 80 to see if its open just like I always have.  Is this true or am I way out in deep space nine? 

upelister
L2 Linker

Hello,

 

I think For the syn-scan (with no Threat prevention profile) or telnet you can discover open ports, in traffic logs it should be appear as "incomplete". In session logs also it should be on "discard" state. 

 

**Against scanning zone-protection profiles has good prevetion options.

 

 

UP
reaper
L7 Applicator

@MarioMarquez  your assumption is correct

 

you can decrease your external footprint by using application-default in all of your rule so that only the ports you actually expose to the outside are open  but the ports that are open are open so can be connected to via telnet

 

to protect from portscans you should enable a zone protection profile with host sweep and port scan set to block so that scanners will be detected and blocked after a number of suspicious connections

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
Loyces
L0 Member

This chapter teaches how to scan the operating system for viruses and how to stop DDoS attacks. Although applications such as Zombie Zapper are not foolproof, they can still help you prepare against such attacks prepaidcardstatus

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!