Randomly allocated high tcp ports on both client/server?

Randomly allocated high tcp ports on both client/server?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Randomly allocated high tcp ports on both client/server? study 02-28-2008
Posted by =?Utf-8?B?c3R1ZHk=?= on February 28, 2008, 6:34 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
We unfortunately have a firewall (hardware based not the host based) between
this one client (only one, the others are on our LAN) and our domain
controller.
Outgoing traffic are not blocked on either side.

We won't modify the registry to use a static port for RPC for some reason.
And we can't use the VPN.
So on the hardware firewall that's protecting the domain controller (no host
based firewall) side, we're going to allow all traffic from that one client
to the domain controller.

On the client side (on the hardware firewall, there's no host based firewall
on the client) the usual MS ports are open ex) 135, 137 U, 138 U, 139, 445.
Do we need to open the dynamic ports on the firewall that's protecting the
client side 1024:65535 or just by opening all traffic on the domain
controller side as I mentioned above will take care of the traffic?

Thanks

Posted by S. Pidgorny on March 1, 2008, 3:13 am
If you were  Registered and logged in, you could reply and use other advanced thread options
"We won't modify the registry to use a static port for RPC for some
reason." - is that a legitimate reason? Your other options are opening range
of ports between the hosts, allowing all traffic between the client and the
DC, and decommisioning the hardware firewall. I would start with fixing the
port.


--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

> We unfortunately have a firewall (hardware based not the host based)
> between
> this one client (only one, the others are on our LAN) and our domain
> controller.
> Outgoing traffic are not blocked on either side.
>
> We won't modify the registry to use a static port for RPC for some reason.
> And we can't use the VPN.
> So on the hardware firewall that's protecting the domain controller (no
> host
> based firewall) side, we're going to allow all traffic from that one
> client
> to the domain controller.
>
> On the client side (on the hardware firewall, there's no host based
> firewall
> on the client) the usual MS ports are open ex) 135, 137 U, 138 U, 139,
> 445.
> Do we need to open the dynamic ports on the firewall that's protecting the
> client side 1024:65535 or just by opening all traffic on the domain
> controller side as I mentioned above will take care of the traffic?
>
> Thanks



Posted by =?Utf-8?B?c3R1ZHk=?= on March 3, 2008, 12:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks for the reply.
So the high tcp ports need to be opened on the client side as well even
though the client is initiating the connection and the outbound traffic are
not blocked?
I was hoping that we just needed to open the ports on the DC side.

"S. Pidgorny <MVP>" wrote:

> "We won't modify the registry to use a static port for RPC for some
> reason." - is that a legitimate reason? Your other options are opening range
> of ports between the hosts, allowing all traffic between the client and the
> DC, and decommisioning the hardware firewall. I would start with fixing the
> port.
>
>
> --
> Svyatoslav Pidgorny, MS MVP - Security, MCSE
> -= F1 is the key =-
>
> * http://sl.mvps.org * http://msmvps.com/blogs/sp *
>
> > We unfortunately have a firewall (hardware based not the host based)
> > between
> > this one client (only one, the others are on our LAN) and our domain
> > controller.
> > Outgoing traffic are not blocked on either side.
> >
> > We won't modify the registry to use a static port for RPC for some reason.
> > And we can't use the VPN.
> > So on the hardware firewall that's protecting the domain controller (no
> > host
> > based firewall) side, we're going to allow all traffic from that one
> > client
> > to the domain controller.
> >
> > On the client side (on the hardware firewall, there's no host based
> > firewall
> > on the client) the usual MS ports are open ex) 135, 137 U, 138 U, 139,
> > 445.
> > Do we need to open the dynamic ports on the firewall that's protecting the
> > client side 1024:65535 or just by opening all traffic on the domain
> > controller side as I mentioned above will take care of the traffic?
> >
> > Thanks
>
>
>

Posted by S. Pidgorny on March 8, 2008, 9:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Yes, that's the DC side.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

> Thanks for the reply.
> So the high tcp ports need to be opened on the client side as well even
> though the client is initiating the connection and the outbound traffic
> are
> not blocked?
> I was hoping that we just needed to open the ports on the DC side.
>
> "S. Pidgorny <MVP>" wrote:
>
>> "We won't modify the registry to use a static port for RPC for some
>> reason." - is that a legitimate reason? Your other options are opening
>> range
>> of ports between the hosts, allowing all traffic between the client and
>> the
>> DC, and decommisioning the hardware firewall. I would start with fixing
>> the
>> port.
>>
>>
>> --
>> Svyatoslav Pidgorny, MS MVP - Security, MCSE
>> -= F1 is the key =-
>>
>> * http://sl.mvps.org * http://msmvps.com/blogs/sp *
>>
>> > We unfortunately have a firewall (hardware based not the host based)
>> > between
>> > this one client (only one, the others are on our LAN) and our domain
>> > controller.
>> > Outgoing traffic are not blocked on either side.
>> >
>> > We won't modify the registry to use a static port for RPC for some
>> > reason.
>> > And we can't use the VPN.
>> > So on the hardware firewall that's protecting the domain controller (no
>> > host
>> > based firewall) side, we're going to allow all traffic from that one
>> > client
>> > to the domain controller.
>> >
>> > On the client side (on the hardware firewall, there's no host based
>> > firewall
>> > on the client) the usual MS ports are open ex) 135, 137 U, 138 U, 139,
>> > 445.
>> > Do we need to open the dynamic ports on the firewall that's protecting
>> > the
>> > client side 1024:65535 or just by opening all traffic on the domain
>> > controller side as I mentioned above will take care of the traffic?
>> >
>> > Thanks
>>
>>
>>



Similar ThreadsPosted
MSN IO Ready Bytes Really High April 3, 2006, 5:21 pm
High Availability on a CLM Managed PKI January 24, 2008, 9:59 am
Unexplained high broadband traffic October 13, 2007, 10:49 am
High Quality Ebel 1911 September 15, 2008, 11:01 pm
Malware issue regarding high broadband traffic and Norton 360 August 6, 2007, 9:19 am
Re: PORTs June 27, 2005, 12:14 pm
Re: PORTs June 27, 2005, 12:12 pm
Windows Ports when used on DMZ June 27, 2005, 12:08 pm
Closing ports June 27, 2005, 12:56 pm
WSUS ports November 30, 2005, 9:35 am

The site map in XML format XML site map

Contact Us | Privacy Policy