Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

CSA security

Hello!

I have deployed CSA with policy that allow only VPN tcp and udp traffic with my VPN concentrator on all interfaces, and all ip stack hardening policies against port scans....and DENY ALL TCP UDP....

When I have laptop in my local LAN network i can not use any protocol except make tunnel......

The problem is when I use particular scanner like GFI Lan guard I get over UDP - epmap port 135 computer name and the domain name.

Why CSA can not deny this?

10 REPLIES
Blue

Re: CSA security

The hosts are probably advertising NetBIOS information in several ways and may have registered this information elsewhere.

If you turn off the Server service and disable NetBIOS over TCP on the scanned hosts, that should prevent remote Windows enumeration.

Also, if you have WINS and Computer Browser enabled on the scanning host, it can use that information to resolve IP adresses to names.

Tom

Community Member

Re: CSA security

Hello! I know what You mean.

But why should I disable netbios on the scanned host.

Should CSA deny any udp traffic if i had that in policy?

There is no any WINS and I can not browse scanned host.

Blue

Re: CSA security

Hi Fisko,

If you want to prevent NetBIOS enumeration, you can either create rules preventing the host from accepting NetBIOS and Location Service connections or try turning off the Server service and disabling NetBIOS over TCP/IP on a host.

The default CSA rules allow hosts to offer these services.

NetBIOS allows the host to advertise and register its name and workgroup/domain with any name service that is listening and storing the information on the local subnet.

NetBIOS over TCP/IP allows it to cross subnets to register with name services.

The location service (port 135) provides endpoint mapping.

The Server service will also advertise to name services.

Tom

Community Member

Re: CSA security

If I put the rule

allow TCP/10000, UDP/500, UDP/4500 as client

deny TCP/0-65535 and UDP/0-65535 as client/server

how can CSA allow netbios?

Bronze

Re: CSA security

Is there another allow network access rule trumping the deny in another Module?

Blue

Re: CSA security

NetBIOS is allowed by default via the required system module.

Unless you make a priority deny blocking it or disable the allow rule, it will still be allowed.

Tom

Community Member

Re: CSA security

Other think that i find is that CSA protected machine brodcast all netbios info on broadcast ip of the segment even if all upd except udp/4500 is denied?

Why CSA does not stop this traffic?

Blue

Re: CSA security

Being CSA protected doesn't stop a host from being a client and that sounds like where the broadcast is coming from.

You can stop this via CSA or Windows settings.

Community Member

Re: CSA security

Strange...I add rule deny tcp /udp 135 with priority and after scan there is no open ports....

Blue

Re: CSA security

Precisely.

This traffic is allowed by default in the "All applications, server for basic services" rule in the "Required System Module" as I mentioned in an earlier post.

You must either deny it (as you just did) or modify\disable the allow rule.

Tom S

294
Views
5
Helpful
10
Replies
CreatePlease to create content