topic Open ports found on existing and non-existing IPs in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5445#M187 <HTML><HEAD></HEAD><BODY><P>Our weekly scans show open ports for devices that have locked down rules. &nbsp;For example we allow inbound access for https but the external scans show ports TCP 1720, 5060 and 2000. &nbsp;We are also seeing TCP 1720 on non-existing IPs. &nbsp;I have used Tenable and NMAP scanners to verify. &nbsp;Any ideas?</P></BODY></HTML> Thu, 17 Aug 2017 16:56:30 GMT David_Chau 2017-08-17T16:56:30Z Open ports found on existing and non-existing IPs https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5445#M187 <HTML><HEAD></HEAD><BODY><P>Our weekly scans show open ports for devices that have locked down rules. &nbsp;For example we allow inbound access for https but the external scans show ports TCP 1720, 5060 and 2000. &nbsp;We are also seeing TCP 1720 on non-existing IPs. &nbsp;I have used Tenable and NMAP scanners to verify. &nbsp;Any ideas?</P></BODY></HTML> Thu, 17 Aug 2017 16:56:30 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5445#M187 David_Chau 2017-08-17T16:56:30Z Re: Open ports found on existing and non-existing IPs https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5446#M188 <HTML><HEAD></HEAD><BODY><P>Any chance you have a VoIP configuration or a remnant thereof? Do the IP addresses at least look familiar? Can you ARP for them?</P></BODY></HTML> Thu, 24 Aug 2017 07:18:03 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5446#M188 Peter_Sandkuijl 2017-08-24T07:18:03Z Re: Open ports found on existing and non-existing IPs https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5447#M189 <HTML><HEAD></HEAD><BODY><P>No VOIP servers configured on that network that I know of. &nbsp;For the IPs I know that are live, we have rules that&nbsp;drop that traffic.</P></BODY></HTML> Thu, 24 Aug 2017 19:18:25 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5447#M189 David_Chau 2017-08-24T19:18:25Z Re: Open ports found on existing and non-existing IPs https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5448#M190 <HTML><HEAD></HEAD><BODY><P>Hi!</P><P></P><P>Check this SK about the SIP port.&nbsp;<A class="link-titled" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk65072&amp;partition=Advanced&amp;product=Security" title="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk65072&amp;partition=Advanced&amp;product=Security">How to disable &amp;apos;fw early SIP nat&amp;apos; chain / SIP inspection</A>&nbsp;</P><P></P><P>Regarding H323, try deleting all h323 services on the dashboard (if you are not using voip services) and install policy.<BR /><BR />That should do</P></BODY></HTML> Thu, 21 Dec 2017 17:03:47 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/5448#M190 Juan_Lobera 2017-12-21T17:03:47Z Re: Open ports found on existing and non-existing IPs https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/77502#M5938 <P><a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11254">@David_Chau</a>&nbsp;We just observed similar behavior after an external scan. I see the thread here kind of died off... did you ever get a definitive answer to account for this behavior?</P> Fri, 06 Mar 2020 18:20:04 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/77502#M5938 Daniel_Taney 2020-03-06T18:20:04Z Re: Open ports found on existing and non-existing IPs https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/145185#M22758 <P>Check this: <A href="https://community.checkpoint.com/t5/Russian/All-hosts-behind-Check-Point-have-open-tcp-1720-port-in-port/m-p/11305" target="_blank">https://community.checkpoint.com/t5/Russian/All-hosts-behind-Check-Point-have-open-tcp-1720-port-in-port/m-p/11305</A></P> Thu, 31 Mar 2022 20:38:00 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/145185#M22758 Zolo 2022-03-31T20:38:00Z Re: Open ports found on existing and non-existing IPs https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/145190#M22759 <P>Hello,</P> <P>Confirm that define rules are correctly matching the traffic and look for NAT rules for any port forwardings</P> Thu, 31 Mar 2022 21:40:45 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Open-ports-found-on-existing-and-non-existing-IPs/m-p/145190#M22759 K_montalvo 2022-03-31T21:40:45Z