Solved

Forward source port in forefront TMG 2010?

Posted on 2014-03-12
7
2,094 Views
Last Modified: 2014-03-13
I have a forefront TMG 2010 server setup as my firewall. I have a new vault to cloud system setup for my backups. The traffic leaves on UDP 1197 but comes back on a variable port from 10,000 to 65,000. The vault people claim the issue is with my firewall but I have never once seen traffic come back in the firewall on 1197. I can see that the source port is 1197 but the destination port is 10,000 to 65,000. If the traffic came back in on destination port 1197 then I can forward that with no problem.

Can I forward based on source port and not destination port? Is the issue on the vault side?

Here is what they sent me to show the traffic is leaving their firewall no problem but it looks to me like it is trying to access port 62221 on my firewall and not 1197.

16:25:45.145024 IP 10.200.1.41.1197 > 209.242.XXX.XXX.62221: UDP, length 22
0
Comment
Question by:Biofilminc
  • 4
  • 3
7 Comments
 
LVL 37

Accepted Solution

by:
Jamie McKillop earned 500 total points
Comment Utility
Hello,

You can't forward based on source port but you can set a port range as the destination. You should create a rule that forwards port 10,000 to 65,000. Since this is a large range, I recommend you lock the rule down to the source IPs of the cloud servers.

-JJ
0
 

Author Comment

by:Biofilminc
Comment Utility
I read online its a bad idea to do that and takes up a lot of resources. Is this not true?
0
 
LVL 37

Expert Comment

by:Jamie McKillop
Comment Utility
Can you provide the source that states this? I don't see why it would take up a lot of resources.

-JJ
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 

Author Comment

by:Biofilminc
Comment Utility
Either way I have never once received traffic on port 1197.

Does the info they gave me show that it should go to 1197 or in this case 62221.

They say its my fault and I don't know how to port forward 1197. I can't forward traffic that I do not get.

------------------------------------------------------------
16:25:45.145024 IP 10.200.1.41.1197 > 209.242.XXX.XXX.62221: UDP, length 22
0
 
LVL 37

Expert Comment

by:Jamie McKillop
Comment Utility
You won't see traffic coming back in 1197. The traffic is coming back on a random port. You need to allow 1197 outbound and 10,000 - 65,000 inbound, if I understand correctly.

-JJ
0
 

Author Comment

by:Biofilminc
Comment Utility
According to Unitrends that is not the case and it should come in on port 1197 and its not because it's my fault. They won't help, just point blame. I forwarded all the ports and have not seen anything get blocked but still no luck. Its a Unitrends problem not mine, they just won't do anything about it.

Thanks for your help.
0
 

Author Closing Comment

by:Biofilminc
Comment Utility
Fixed my forwarding problems
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

If you migrate a Terminal Server licenses server inside the 2008 server family, you can takte advantage of the build-in migration tool. If you like to migrate an older 2003 Server (and the installed client CALs) to a 2008 R2 server for example, you …
To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now