How can I block ports from outside and allow it for internal communications?

[Shehan_Wickrama]

Hello Guys,

One of our vulnerability scanner gave the following ports as vulnerable, so we want those ports to be blocked from outside and to be allowed from the inside for inside communications.

These are the ports

264/tcp - fw1_generic.
500/udp - ikev1.
18231/tcp

18264/tcp - cp_ica

how can i do this?

Thanks

[Brian_Deutmeyer]

I feel like I might be missing something with your question, but I think there are several ways to achieve this...

SRC: Internal Networks Group [NEGATED] | DST: Any | SVC: ports | ACT: drop

--or--

SRC: Internal Networks Group | DST: Any | SVC: ports | ACT: allow 

      * I'd have several more specific rules of the above rule with explicit destinations...

SRC: Any | DST: Any | SVC: ports | ACT: drop

--or--

Other combinations...

[Shehan_Wickrama]

Hi Brian,

Thank You for the reply.

Regards,

Shehan

[PhoneBoy · Accepted solution]

Some of these are covered by implied rules.

To confirm this, go to Global Properties, click the appropriate checkbox, and install policy.

You will see log entries on Rule 0.

In which case you will have to work to disable the implied rules, but this is NOT recommended.

Refer to: How to completely disable FireWall Implied Rules 

[Shehan_Wickrama]

Hi Dameon,

Thanks for the reply. I have disabled some with the implied rules.

Regards,

Shehan

[kreynolds]

G             reat answer PhoneBoy, how to do this for 600 and 1100? thc