Open Ports on Cisco Router

From: bob bob (bb88011_at_yahoo.com)
Date: 03/25/05

  • Next message: shankarnarayan.d_at_netsol.co.in: "Security on CDMA for Banking Applications" 
    Date: Fri, 25 Mar 2005 10:33:56 -0800 (PST)
To: security-basics@securityfocus.com

    I have a Cisco 1720 router that showed telnet open
    after a recent audit. I closed down telnet by
    applying an acl to the vty lines and then nmap'ed from
    the outside to verify. Telnet is indeed closed, but
    other ports appeared open now! What's more, different
    ports appear open when scanning at different times.
    It showed tcp ports 21, 25 and 80 open at one time,
    but in another scan showed 143 in addition to the
    above. Late in the evening, it showed none of the
    above open, but a range of ports starting around 8000.
     No UDP ports show open.

    I ran nmap with the following command:

    nmap -sT -P0 -sV -v -p 1-65535 A.B.C.D

    Here is a portion of the router config:

    version 12.3

    . . .
    ip subnet-zero
    no ip source-route

    . . .
    interface FastEthernet0
      ip address 10.0.0.1 255.255.255.0
      ip nat outside
      speed auto
      half-duplex
    !
    interface Serial0
      ip address A.B.C.D 255.255.255.252
      ip access-group filter_outside_in in
      no ip redirects
      no ip unreachables
      no ip proxy-arp
      no nat outside
      no fair-queue
      no cdp enable
    !
    ip nat inside source list 10 interface Serial0
    overload
    ip classless
    ip route 0.0.0.0 0.0.0.0 Serial0
    no ip http server

    . . .

    ip access-list extended filter_outside_in
      deny ip 10.0.0.0 0.255.255.255 any
      deny ip 127.0.0.0 0.255.255.255 any
      deny ip 172.16.0.0 0.15.255.255 any
      deny ip 224.0.0.0 15.255.255.255 any
      deny ip host 0.0.0.0 any
      deny icmp any timestamp-request
      deny icmp any redirect
      deny icmp any mask-request
      deny icmp any traceroute
      deny icmp any echo
      permit ip any any
    access-list 10 permit 10.0.0.0 0.0.0.255
    ----------------------------------------

    So, the router is NAT'ing, and, btw, it also has a
    firewall behind it. The ports that show up in the
    scans of the router match up very well with the ports
    used regularly at this location, so I thought it might
    have something to do with NAT dynamically openning
    ports. However, it still seems very strange to me and
    I wanted to know if anyone else has seen this behavior
    and what explains it. TIA!

    Bob

                    
    __________________________________
    Do you Yahoo!?
    Yahoo! Small Business - Try our new resources site!
    http://smallbusiness.yahoo.com/resources/

  • Next message: shankarnarayan.d_at_netsol.co.in: "Security on CDMA for Banking Applications"

    Relevant Pages

    • Re: ATTN Tony Whitmore please
      ... mean that no-one can connect to your telnet or http servers from the ... You still need to close the ports. ... what else I can say about that really - like I say its not a router I've ...
      (comp.security.firewalls)
    • RE: Open Ports on Cisco Router
      ... It's a border router with a Fortigate firewall behind ... > access-list 100 deny icmp any host ... Open Ports on Cisco Router ...
      (Security-Basics)
    • Re: Open Ports on Cisco Router
      ... bob bob wrote: ... > I have a Cisco 1720 router that showed telnet open ... > ports appear open when scanning at different times. ... > deny icmp any timestamp-request ...
      (Security-Basics)
    • Re: ATTN Tony Whitmore please
      ... If your telnet and http ports are open to the internet (as your pcflank scan ... My feeling is that unless you have *good* reason to allow connections to the ... http and telnet ports on your router from the internet, ...
      (comp.security.firewalls)
    • Re: NAT, cable modem, and servers
      ... Yeah, its called finding out what ports Telnet uses, and then use Port ... Forwarding on the router to map the ports to the machine that's is running ... I would suggest that you install a software firewall like BlackIce or one of ...
      (comp.security.firewalls)