Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Need Help on Port Blocking in ASA

Dear All,

I have configured firewall and allow only port 443 and deny all tcp ports for destination, but when i am scanning from port scanner it shows several tcp ports are enabled.. need your seuggestion and help on it.. how to block these tcp ports..

Early response is required..


Super Bronze

Need Help on Port Blocking in ASA


You have not given any configurations to reference or mentioned at all the ports that were open in the scanner.

We would need a bit more information to go on.

- Jouni

New Member

Need Help on Port Blocking in ASA

Below is the configuration..

access-list extended permit tcp any host ip eq https

access-list extended deny ip any any

Super Bronze

Need Help on Port Blocking in ASA


Still don't know the ports that were supposedly open.

Though if that is the ACL you have bound to the "outside" interface on the ASA then it should be blocking the connections through the ASA for everything else other than the TCP/443 for a single destination IP address.

Then there is naturally the ASAs own services and ports on which its listening on.

You can check that with the following command

show asp table socket

Most likely the ports that are open on the ASA are the ones used for management purposes perhaps

Those set with the following commands




You also have the option to create an ACL that blocks all traffic to the ASA "outside" interface IP address. You can then attach it with "access-group" command

access-group in interface outside control-plane

This would limit the "To the Box" traffic. Though the above mentioned management commands "telnet", "ssh" and "http" would still override this ACL.

- Jouni