Cisco Catalyst 3650, opened port tcp 16113 - how to disable
Following a TCP scan port on our Catalyst 3650 from the Security team, we found port TCP 16113 is opened on our boxes. I found this is used by Network Mobility Services Protocol (NMSP) protocol; however, we don' t use it & want it disabled.
I was not able to find on Cisco documentation how to remove this service & close this TCP port. We use 3.3.3 IOS-XE train.
I haven't found any information on shutting this down directly, but you can potentially use control plane policing to drop packets destined to this port.
class-map match-all CM_NMSP
match access-group name ACL_NMSP
ip access-list extended ACL_NMSP
permit tcp any any eq 16113
service-policy input PM_CoPP
thanks for your interest & your answer. Control-Plane policy is a good idea, unfortunately, the CoPP configuration is limited on Calyst 3650 (we can't just police on pre-defined classes)
It seems the only think we can do it to disable NMSP replies on an interface basis (nmsp attachment suppress on the interface); the port will still appear open on that interface, but the switch should not reply to NMSP messages.
Another solution would be to put ACL on every interfaces, but this will be hard to maintain.
We also had this problem, but in the newer versions you can disable it easily with no nmsp enable. It seems like this makes an ACL for e.g. the vlan, but it helped us a lot. It was important for us to make this port not accessible. We use now 03.06.03.
Hi everyone, I would like to thank you in advance for any help you can provide a newcomer like myself!
Im studying the 100-105 book by Odom and am currently on the topic of Port security. I purchased a used 2960 and I'm trying to follow a...
While deploying a number of 18xx/2802/3802 model access points (APs), which run AP-COS as their operating platform. It can be observed on some occasions that while many of their access points were able to join the fabric WLC withou...
I am going to design and build an LAN network under a tunnel underground with long distance between the switches.
I will have 2 Catalyst switches and 8 Industrial IE3000, and they will be connected with fiber.
For now I am planning on use Layer-2 s...