Re: [fw-wiz] trusted & untrusted ports

From: Monkey Boy (hydra291_at_hotmail.com)
Date: 11/10/03

  • Next message: Andy Lyakhovetskiy: "RE: [fw-wiz] Cisco VPN client behind a Netscreen" 
    To: firewall-wizards@honor.icsalabs.com
Date: Mon, 10 Nov 2003 08:35:42 -0500

    >Q1 - How to identifiy trust vs untrusted ports. As sometimes, users working
    >within our network will ask to open certain ports in the firewall in order
    >to allow communication to a certain application outside the coorporate
    >network. From security prespective, based on what evaluation should i
    >accept or reject opening the requested port(s) ? maybe it will know to be
    >used by hackers, or viruses as a threat.

    You would have to ask management what is and is not acceptable to them. Most
    ports that are opened by an application within your network will hand off
    that request on an ephemeral port as well. It is not as if say IE will hand
    off a browser request on port 80, it will handled by an ephemeral port. If
    you are going to be running services such as FTP, SMTP and the such then
    they do listen on a generally well known port such as 21 or 25 respectively.
    Those types of issues are fairly straight forward to resolve. However say
    running an irc server on 6667 is something your being asked I would have to
    take that up with management. That will definitely impact security,
    bandwidth, among other things. Bottom line each service which you are being
    asked to allow out has to be evaluated separately.

    >Q2 - Reading some technical documents about accessing applications over
    >the net, I noticed that sometimes the connection is not a client/server
    >technique, it could be through the http port, in other words, no need to
    >open specific port in order to be able to access the net application from
    >within our network coorporate since it is using the http port.

    All communications outside of peer to peer stuff is based on a client/server
    model Hilal. Even if you are tunneling traffic out over port 80 it is still
    going out that port as a client request to a server somewhere. That does not
    change at all. Most services operate on well known ports such as the
    afore-mentioned FTP and SMTP. If you have employee's tunnelling traffic out
    over http then it may be time to have a chat with them and human resources
    over that being forbidden by company policy. Speaking of company policy you
    would need to have a clear and concise one which everyone has to read and
    sign off on.

    regards,

    Don

    _________________________________________________________________
    MSN 8 with e-mail virus protection service: 2 months FREE*
    http://join.msn.com/?page=features/virus&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Andy Lyakhovetskiy: "RE: [fw-wiz] Cisco VPN client behind a Netscreen"

    Relevant Pages

    • RE: How to find a changing IP on ethernet network
      ... Cisco Aironet 1200 Aps). ... part of their newCisco Self-Defending Network Initiative. ... Port Security is a good Cisco feature for a small LAN but when working with ... conjunction with Port Security. ...
      (Security-Basics)
    • RE: How to find a changing IP on ethernet network
      ... Port Security is a good Cisco feature for a small LAN but when working ... with large networks with roaming users, I would use Port Authentication ... Identity Based Network Security and uses 802.1x at the client ... firewall with virus/spam protection, URL filtering, ...
      (Security-Basics)
    • RE: How to find a changing IP on ethernet network
      ... Port Security is a good Cisco feature for a small LAN but when working ... with large networks with roaming users, I would use Port Authentication ... Network Security Specialist ... firewall with virus/spam protection, URL filtering, ...
      (Security-Basics)
    • RE: network auditing
      ... I was just reading the thread on the "NASA security Audit" ... Port scan the target network IP. ...
      (Security-Basics)
    • RE: How to find a changing IP on ethernet network
      ... called "port security". ... tell it how many MAC ... to issue an SMTP trap to your Network Management ...
      (Security-Basics)