how do I disable ports to help secure the network?

[tahoe2]

Hello. I want to stop the attacks on our W2K server running Citrix MetaFrame 1.8.
Every day the security log is full (at least 1000 entries) of failed logon attempts from workstations and domains I've never heard of.

Is there a program that will tell me what ports are open, and if not, how do I find out? How do I disable ports?

Thanks!

Corie

 

[CluelessJon]

Where the HELL is your firewall!!

Regards

Jonno BrainDump Specialist
MCSE(NT) MCSA(2k) CCNA

 

[tahoe2]

It's an old linux box that the DLS line plugs into, and that's all I know about that. You think it's not doing it's thing? How can I tell, since I know nothing about hardware FW's, other than what the company that built the network told me, and thats that if I have internet access, the firewall is running.

Corie

 

[LoJACK]

ooh man.. if you are managing the network then you have to know what hardwares are on your network. You can always run a Cisco PIX firewall which is a hardware firewall to filter the ports being used. Programming Cisco PIX is not a walk in the park if you don't know what you are doing. You can look into Sonicwall which is easier to configure.

If you want to really secure your network then you can run a hardware firewall on a network layer and a software layer firewall like Microsoft ISA.

You can use a port scanner to see which ports are open.

 

[jmarquart]

You can also use IPSec filters in Windows 2000 to block/allow IP ports and subnet traffic. This is quite convenient if you are unsure how to manage/monitor the existing firewall. I realize this is redunant, but at least you will have control of what traffic is coming in and out of your network.

See the following link and refer to the IPSec section to get you started (you may need to register on this site to view the article):

http://www.minasi.com/showdoc.asp?docname=nws0110.htm

 

[tahoe2]

Thanks! That guy writes very well. I was able to filter out everything that doesn't go through the firewall first. I think that will hold us until the Network Security Engineer comes out next Thursday.

I really appreciate it!

Does anybody have a favorite port scanner utility? I tried YAPS, but I can't figure out what the heck the report says.

Corie

 

[jlong515]

NMAP is a good port scanner, and there are numerous others.

Also you can run netstat -a from the command line to show all connected and listening ports. The firewall should be blocking all ports except those that absolutely needed...email(if you host your own), FTP, Web, etc...

Good luck...

Jeff

MCSE,CCNA,ASE