Port Scans & Telnets on a PA running 8.0

[MarioMarquez]

I am new to the world of PA and next gen firewalls and took some online training.  I discovered that in the Traffic Proccessing phase before App ID gets applied in the Security Policy that the session is already allowed to start if the layer 4 ports are allowed in the policy.  This makes me wonder if I were to run a port scan on my public address or telnet to a specific port that I would still be able to find out if its open using those same old tricks.  In my mind since all the telnet trick does is send a SYN packet to the IP address I'm troubleshooting than the PA should still be able to send back a SYN ACK for the port I'm checking thus letting me know if its open or not.  I understand that the point of App ID is to prevent hackers from using any application they want over a default port (e.g using http over port 22) but in theory if the session is allowed to start before App ID kicks in then I can still telnet to port 80 to see if its open just like I always have.  Is this true or am I way out in deep space nine? 

[upelister]

Hello,

I think For the syn-scan (with no Threat prevention profile) or telnet you can discover open ports, in traffic logs it should be appear as "incomplete". In session logs also it should be on "discard" state. 

**Against scanning zone-protection profiles has good prevetion options.

[reaper]

@MarioMarquez  your assumption is correct

you can decrease your external footprint by using application-default in all of your rule so that only the ports you actually expose to the outside are open  but the ports that are open are open so can be connected to via telnet

to protect from portscans you should enable a zone protection profile with host sweep and port scan set to block so that scanners will be detected and blocked after a number of suspicious connections

[Loyces]

This chapter teaches how to scan the operating system for viruses and how to stop DDoS attacks. Although applications such as Zombie Zapper are not foolproof, they can still help you prepare against such attacks prepaidcardstatus