cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

PCI Scan turns on ports dynamically

Tenable Scan will dynamically open up various ports "SMTP Server Non-standard Port Detection" only on 2 out of the 16 gateways in our production environment. So far it has only happened on the secondaries.

It does this everytime even after a fresh reboot of the gateway. 

All GW's are running R77.30 Jumbo 286.  Anyone ever heard of this.  We had a case opened a few months back but got no where. Any advice would be greatly appreciated. 

Thanks -pat

0 Kudos
7 Replies
Admin
Admin

Re: PCI Scan turns on ports dynamically

Check Point gateways have userpsace processes that listen on random high ports.

The primary reason for this is to fold specific types of traffic into the processes that perform different types of content inspection.

It's entirely possible that, if you haven't implemented a stealth rule in your rulebase properly, that something like a Tenable may pick up one of these random high ports.

0 Kudos

Re: PCI Scan turns on ports dynamically

Thanks I appreciate the explanation and replies.  We would like to implement an over scan rule / tighten up our stealth rule by not allowing any scans such as implementing SK110873 but so far We have been not successful in getting that change passed.

thanks again

-pat  

0 Kudos
Vladimir
Pearl

Re: PCI Scan turns on ports dynamically

Dameon,

How doe the stealth rule works in situations when GW has to be directly accessible by internal hosts, (i.e. captive portal, user check portal, platform portal, etc.)?

0 Kudos
Admin
Admin

Re: PCI Scan turns on ports dynamically

You would create the various required access rules prior to the Stealth Rule.

In fact, this may be a situation where a Policy Layer might be useful in R80.10+.

0 Kudos
Vladimir
Pearl

Re: PCI Scan turns on ports dynamically

Something like this?

0 Kudos
Admin
Admin

Re: PCI Scan turns on ports dynamically

Yeah like that

0 Kudos

Re: PCI Scan turns on ports dynamically

Hi , I also had this particular findings after a nessus (tenable) scan. Di you already find out the solution to eliminate the findings? thank you very much

 

Capture.JPG

0 Kudos