Cisco 1841 Firewall/Security Settings
Posted on 2006-04-24
Wasn't sure whether to post htis here or in the Router section.
We have a Cisco 1841 Router and are trying to check the firewall/security settings.
I Ran the shields up scan at GRC and got the following.
Results from scan of ports: 0-1055
4 Ports Open
1049 Ports Closed
3 Ports Stealth
1056 Ports Tested
Ports found to be OPEN were: 23, 25, 80, 443
Ports found to be STEALTH were: 137, 138, 139
Other than what is listed above, all ports are CLOSED.
TruStealth: FAILED - NOT all tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.
“Ports found to be OPEN were: 23, 25, 80,443”, all these I expected to be open because we configured them to be for our various services.
So what I'm wondering is about the closed ports, they actually respond if probed and are possibly exploitable, correct?
Also, is there difference between Stealth and Blocked, the definitions I have seen seem to be the same in that a blocked or stealth port will not respond in any way to a probe, as if there is nothing there. Other tests have shown the ports GRC called stealth, are blocked, and the Cisco engineer I talked to at the TAC seemed to be puzzled by the term Stealth.
I know every network is different, but what would be the "Correct" setup? All ports stealth or blocked, except what must be open for services?
I have set points to max, would give more if I could ;)