Snort mailing list archives
RE: What tool? Fastest way to generate port info to build acl protection?
From: "Bristol, Gary L." <gbristol () ou edu>
Date: Fri, 18 Nov 2005 18:58:41 -0600
we have our exchange here limited to 3 ports for Clients to Server comm, the GAL is setup on two ports, and so on. Of course there are some standard also, like port 25 and 691 for SMTP and Exchange LSA port 53 for DNS port 88 for port 135, 445, 1025 port 389 for ldap port 3268 & 3269 for GAL and so on ________________________________ From: snort-users-admin () lists sourceforge net on behalf of Jason Haar Sent: Fri 11/18/2005 6:07 PM To: snort-users () lists sourceforge net Subject: Re: [Snort-users] What tool? Fastest way to generate port info to build acl protection? Turnquist,Wayne wrote:
1st Goal: To map-document all systems and business traffic that needs to cross to/from our site. 2nd Goal: Create cisco acl to install on our router to permit for now all needed ports for goal number 1 and deny everything else
Your 2nd goal will be IMPOSSIBLE without more work than just mapping it. Windows relies heavily on RPC - which involves *dynamically* allocating port numbers. So does Exchange, so does.... There aren't static ports that you could base firewall ACLs on However, regedit is your friend. Read all appropriate Microsoft whitepapers and you may be able to hardwire Active Directory and Exchange and whatever else to use static ports, and then away you go. However, I think you are trying pushing the proverbial up hill there... ;-) For internal Windows networks its usually best to focus on defining categories of machines (e.g. HR, finance) and ACL them off - leaving the rest of the network open. Just my opinion - based on a lot of experience (i.e I've tried to do it too) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This SF.Net email is sponsored by the JBoss Inc. Get Certified Today Register for a JBoss Training Course. Free Certification Exam for All Training Attendees Through End of 2005. For more info visit: http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- What tool? Fastest way to generate port info to build acl protection? Turnquist,Wayne (Nov 18)
- Re: What tool? Fastest way to generate port info to build acl protection? G Ramon Gomez (Nov 18)
- Re: What tool? Fastest way to generate port info to build acl protection? sekure (Nov 18)
- Re: What tool? Fastest way to generate port info to build acl protection? Jason Haar (Nov 18)
- RE: What tool? Fastest way to generate port info to build acl protection? Jim Hendrick (Nov 18)
- <Possible follow-ups>
- RE: What tool? Fastest way to generate port info to build acl protection? Briggs, Bruce (Nov 18)
- RE: What tool? Fastest way to generate port info to build acl protection? Bristol, Gary L. (Nov 18)
- Re: What tool? Fastest way to generate port info to build acl protection? Richard Bejtlich (Nov 18)