Skip to main content
riaanwest
riaanwest
New Member
May 22, 2018
Question

Application Sensor not blocking traffic

  • May 22, 2018
  • 2 replies
  • 4516 views

Hi Guys,

 

I have a firewall rule allowing all ports to all destinations, but I include an application sensor that blocks smtp as an override. When I telnet from a server to an internet host on port 25 the traffic is allowed.

 

Is there any reason why its is allowed and not blocked as intended to?

 

Please see screenshot attached.

 

 

Your help will be much appreciated.

 

Thanks

    2 replies

    Nicholas_Doropoulos
    Nicholas_Doropoulos
    New Member
    May 28, 2018

    I think the best starting point would be to confirm that the traffic is being matched by the policy you have attached the Application Control profile to. What do the logs say? Have you run a diag sniffer packet?

    hmtay_FTNT
    Staff
    hmtay_FTNT
    Staff
    May 28, 2018

    Hello riaanwest,

     

    What you are doing is blocking the SMTP protocol. The Application Control module identify a session by its payload, not the port number. If you send a Telnet packet on port 25, it will not be identified as SMTP and will be allowed to go through. If you want to block port 25, you just need to create a firewall policy that blocks the port number 25. Thanks.

     

    Homing

    Terms & ConditionsAccessibility statement