Contact support if the issues persist

If port forwarding is in place, the NGAF may not be able to block the traffic on those ports.

Network Address Translation (NAT) configured on your NGAF, check if there are any misconfigurations that might be exposing ports unintentionally. Ensure that NAT rules are properly configured and not redirecting traffic to unintended ports.

If you have already created policies to block RDP, SSH, and SMB ports, but there are still open ports on your NGAF (Next-Generation Application Firewall), it is possible that there might be other factors causing the issue. Here are some steps you can take to investigate and resolve the open port vulnerabilities:

Verify your policies: Double-check your policies to ensure that they are correctly configured to block the desired ports (RDP, SSH, SMB). Make sure you have applied the policies correctly and they are active.

Review the policy order: Check the order of your policies to ensure that the blocking policies for RDP, SSH, and SMB ports are placed above any permissive or less restrictive policies. Policy order determines the priority of rules, so placing the blocking policies higher in the order ensures they are enforced before other rules.

Check for conflicting rules: Look for any conflicting or contradictory rules that might override your blocking policies. Sometimes, a permissive rule or an exception rule for specific IP addresses or subnets can unintentionally allow access to certain ports.

Review NAT configurations: If you have Network Address Translation (NAT) configured on your NGAF, check if there are any misconfigurations that might be exposing ports unintentionally. Ensure that NAT rules are properly configured and not redirecting traffic to unintended ports.

Perform a port scan: Use a port scanning tool or an external port scanner to verify the open ports on your NGAF. This will help you identify the specific ports that are open and potentially pinpoint any misconfigurations or overlooked policies.

Review system logs: Check the NGAF system logs for any relevant information or error messages related to the open ports. Logs might provide insights into why the blocking policies are not effective or if there are any issues with the NGAF configuration.

Update NGAF firmware: Ensure that your NGAF is running on the latest firmware version. Firmware updates often include bug fixes and security patches that can address known vulnerabilities.

Contact Sangfor support: If you have tried the above steps and are still experiencing open port vulnerabilities, it is recommended to reach out to Sangfor support. They can provide further assistance, review your specific NGAF configuration, and help troubleshoot any potential issues or bugs that might be causing the open port problem.

It's important to note that resolving open port vulnerabilities requires a comprehensive understanding of your network environment, NGAF configuration, and security policies. Working with Sangfor support or a qualified network security professional will ensure that the vulnerabilities are addressed effectively and your NGAF is properly secured.

Disable the port on the device and see whether it still appears. You have implemented a policy to ban all ports there, therefore there should be no problem.

Firmware or software issues: Make sure your NGAF device has the most recent firmware or software upgrades. Vulnerabilities or flaws in the NGAF firmware or software can sometimes result in false reporting of open ports or interfere with the effectiveness of blocking rules. Updating to the most recent version can assist in resolving such situations.

You may tighten the policy even more by defining specific rules that allow only authorized IP addresses to access the ports and enabling intrusion prevention systems (IPS) to detect and prevent brute force assaults.

Hi,

You can try go to Policies > Add Policies > Click Service from dropdown > Select port that you wanted or Add Custom Port.

Thanks

try to disable the port in the device, see if it still appear . u have do the policy to block all the port there ,so it should not be any issue

SSH 22 is a web brute force attack on the specific port. The intruder or someone is trying to pick up or get the login/password to some account or service

SSH 22 is a web brute force attack on the specific port. The intruder or someone is trying to pick up or get the login/password to some account or service