Farina Ahmed Lv5Posted 15 May 2023 14:19
  
If you have created a policy to block RDP, SSH, and SMB ports, but you still see 145 open ports in your NGAF (Next-Generation Application Firewall), there could be several reasons for this:

Incorrect Configuration: Double-check your policy configurations to ensure that the rules are correctly set to block the desired ports. Verify that the rule conditions, such as source and destination IP addresses, port numbers, and protocols, are accurately defined.

Port Scanning: The open ports you see in the NGAF could be the result of port scanning activities. Port scanning is a technique used to discover open ports on a network. It's possible that the NGAF is detecting the port scanning attempts rather than actual open ports on your network. In such cases, the NGAF may report the detected scanning activities as open ports.

Port Forwarding: Check if there are any port forwarding configurations in your network environment. Port forwarding can redirect incoming traffic from external ports to internal devices, bypassing the NGAF. If port forwarding is in place, the NGAF may not be able to block the traffic on those ports.

Firmware or Software Issues: Ensure that your NGAF device has the latest firmware or software updates installed. Sometimes, vulnerabilities or bugs in the NGAF firmware or software can cause incorrect reporting of open ports or interfere with the effectiveness of blocking policies. Updating to the latest version can help resolve such issues.

Misconfiguration or Policy Conflicts: Review your overall NGAF configuration and policy setup. It's possible that there might be misconfigurations or conflicts in other policies that are allowing certain ports to remain open. Make sure there are no conflicting policies or exceptions that are overriding your blocking rules.

I Can Help:

Change

Moderator on This Board

1
131
3

Started Topics

Followers

Follow

18
8
0

Started Topics

Followers

Follow

Board Leaders