Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About EtcSlc
Community Record
6
Posts
1
Kudos
0
Solutions
Badges
Mar 27 2018
7:42 AM
Well that's just fantastic! Thank you!
... View more
Mar 27 2018
7:03 AM
Just some additional information... For a server that I have a 1:1 NAT for, if I specify port 3389 TCP and UDP but restrict it to a single public IP, I can STILL RDP into that server from other public IPs, not just the one I specified. If I add a 1:Many rule for a system that already has a 1:1 NAT rule and redirect port 3389 to an obscure port, I can no longer RDP into the server; however, that tells me I'd need to redirect all ports to obscure IPs and ports in order to adequately protect that system and maintain the 1:1 NAT. It seems so long as a system has a 1:1 NAT rule AT ALL, then all ports are allowed through to that system, regardless of the ports specified. I hope this is just a misconfiguration or misunderstanding and not a massive security issue.
... View more
Mar 27 2018
6:38 AM
Current Firmware Version: MX 15.4
... View more
Mar 26 2018
3:07 PM
1 Kudo
I did move two servers that don't require a 1:1 NAT to 1:Many and they appear to actually be secure now from outside, but I can't do that for all the services. My understanding of the statement at the top of the Firewall page "Inbound traffic will be restricted to the services and forwarding rules configured below" is what you said... anything not specifically allowed would be blocked. It's as if there's some Allow Any-Any rule somewhere in the config but not exposed to the web interface.
... View more
Mar 26 2018
2:51 PM
That's the problem. NONE of the 1:1 NAT entries include port 3389. In fact, now that I've tested more, I can get to ANY port on the servers from outside, even when they are not in the list of allowed ports. For example, I have ONLY ports 80, 443 and 25 allowed to my Exchange server. I can RDP into it. I have ONLY port 443 allowed to my SharePoint server, and I can get to the central admin site on port 11111 and RDP into it from outside.
... View more
Mar 26 2018
1:45 PM
We have a Meraki MX100 firewall that was set up by a consulting firm. From what I can tell, the firewall is only configured to NAT certain ports through to our servers; however, from outside, I am able to RDP in ANY server that there is a 1:1 NAT rule for, even when none of the rules allow port 3389 through the firewall from outside. In most cases, only ports like 443 and 25 are set in the rules. I haven't gone so far as to test access to ports other than 3389 but even still, why would I be able to connect from outside if the ports are not allowed through in the configuration?
... View more
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 1 | 4998 |
© 2024 Cisco Systems, Inc.
