topic Re: PCI Scan turns on ports dynamically in General Topics

PCI Scan turns on ports dynamically

Patrick_Tuttle — Wed, 14 Mar 2018 19:19:34 GMT

Tenable Scan will dynamically open up various ports "SMTP Server Non-standard Port Detection" only on 2 out of the 16 gateways in our production environment. So far it has only happened on the secondaries.

It does this everytime even after a fresh reboot of the gateway.

All GW's are running R77.30 Jumbo 286. Anyone ever heard of this. We had a case opened a few months back but got no where. Any advice would be greatly appreciated.

Thanks -pat

Re: PCI Scan turns on ports dynamically

PhoneBoy — Fri, 16 Mar 2018 22:25:34 GMT

Check Point gateways have userpsace processes that listen on random high ports.

The primary reason for this is to fold specific types of traffic into the processes that perform different types of content inspection.

It's entirely possible that, if you haven't implemented a stealth rule in your rulebase properly, that something like a Tenable may pick up one of these random high ports.

Re: PCI Scan turns on ports dynamically

Patrick_Tuttle — Mon, 19 Mar 2018 13:32:05 GMT

Thanks I appreciate the explanation and replies. We would like to implement an over scan rule / tighten up our stealth rule by not allowing any scans such as implementing SK110873 but so far We have been not successful in getting that change passed.

thanks again

-pat

Re: PCI Scan turns on ports dynamically

Vladimir — Mon, 19 Mar 2018 17:20:27 GMT

Dameon,

How doe the stealth rule works in situations when GW has to be directly accessible by internal hosts, (i.e. captive portal, user check portal, platform portal, etc.)?

Re: PCI Scan turns on ports dynamically

PhoneBoy — Mon, 19 Mar 2018 18:03:32 GMT

You would create the various required access rules prior to the Stealth Rule.

In fact, this may be a situation where a Policy Layer might be useful in R80.10+.

Re: PCI Scan turns on ports dynamically

Vladimir — Mon, 19 Mar 2018 18:45:49 GMT

Something like this?

Re: PCI Scan turns on ports dynamically

PhoneBoy — Mon, 19 Mar 2018 20:11:43 GMT

Yeah like that

Re: PCI Scan turns on ports dynamically

Richard_Anton_V — Fri, 31 May 2019 02:24:20 GMT

Hi , I also had this particular findings after a nessus (tenable) scan. Di you already find out the solution to eliminate the findings? thank you very much

Re: PCI Scan turns on ports dynamically

DR_74 — Thu, 24 Oct 2019 07:42:39 GMT

Hi,

Got the same behaviour on R80.20 gateway (with Management and gw on the same hardware). The question is why do they have those SMTP ports opened?

Even if "The primary reason for this is to fold specific types of traffic into the processes that perform different types of content inspection." I don't understand why those ports are open.

Of course a Stealth Rules will mitigate the impact... but from a Security point of view, those are still open

Re: PCI Scan turns on ports dynamically

_Val_ — Mon, 28 Oct 2019 07:51:11 GMT

Open port does not represent a security risk. The answer is already given: in case of content inspection, the traffic should be folded for inspection