PCI Scan turns on ports dynamically

[Patrick_Tuttle]

Tenable Scan will dynamically open up various ports "SMTP Server Non-standard Port Detection" only on 2 out of the 16 gateways in our production environment. So far it has only happened on the secondaries.

It does this everytime even after a fresh reboot of the gateway. 

All GW's are running R77.30 Jumbo 286.  Anyone ever heard of this.  We had a case opened a few months back but got no where. Any advice would be greatly appreciated. 

Thanks -pat

[PhoneBoy]

Check Point gateways have userpsace processes that listen on random high ports.

The primary reason for this is to fold specific types of traffic into the processes that perform different types of content inspection.

It's entirely possible that, if you haven't implemented a stealth rule in your rulebase properly, that something like a Tenable may pick up one of these random high ports.

[Patrick_Tuttle]

Thanks I appreciate the explanation and replies.  We would like to implement an over scan rule / tighten up our stealth rule by not allowing any scans such as implementing SK110873 but so far We have been not successful in getting that change passed.

thanks again

-pat  

[Vladimir]

Dameon,

How doe the stealth rule works in situations when GW has to be directly accessible by internal hosts, (i.e. captive portal, user check portal, platform portal, etc.)?

[PhoneBoy]

You would create the various required access rules prior to the Stealth Rule.

In fact, this may be a situation where a Policy Layer might be useful in R80.10+.

[Vladimir]

Something like this?

[PhoneBoy]

Yeah like that

[Richard_Anton_V]

Hi , I also had this particular findings after a nessus (tenable) scan. Di you already find out the solution to eliminate the findings? thank you very much

[Rom_D]

Hi,

Got the same behaviour on R80.20 gateway (with Management and gw on the same hardware). The question is why do they have those SMTP ports opened?

Even if  "The primary reason for this is to fold specific types of traffic into the processes that perform different types of content inspection." I don't understand why those ports are open.

Of course a Stealth Rules will mitigate the impact... but from a Security point of view, those are still open

[_Val_]

Open port does not represent a security risk. The answer is already given: in case of content inspection, the traffic should be folded for inspection