Skip to main content
zeronet
zeronet
New Member
November 28, 2019
Solved

Best practice for thwarting port scanning?

  • November 28, 2019
  • 2 replies
  • 20306 views

I seem to get an awful lot of port scans to port 500, many/most on the same IP block.

I'm certain they're doing an overall scan of the network, but I've just implemented a notification alert on the following:

[ul]
  • SSL VPN login failure
  • IPsec tunnel errors[/ul]

    via Log & Report > Email Alert Settings (300E model) so I can keep tabs if any of my users are having problems (or are the target of a brute force attack).

     

    ..so I'm most aware of the port 500 hits.  However, because these garbage notifications are bloating my inbox, I've overlooked legitimate login failures for my users, unintentionally.

     

    What's the best approach to either stopping these scans from triggering an alert, or blocking the probes?

    I'm fairly new to Fortinet products, so I'm not completely well-versed in the full capabilities of the firewall.

     

    Possible approaches:

    [ul]
  • Block the CIDR of the most frequent offenders for UDP 500 (may/may not be problematic, as it's on the Hurricane Electric network.. most of my users use a local ISP that is not HE - but issues may surface with travel)
  • Whitelist the CIDR's of my users for UDP 500 (which would make their foreign travel a headache for me)
  • Add an Intrusion Detection rule?*
  • Let them scan to their heart's content and filter the email after it hits my inbox (my least desirable solution as its kind of a band-aid)[/ul]

    *I do have Intrusion Detection running, but I haven't yet setup a rule to target this behavior as I'm not entirely sure how the signatures and filters work.

     

    Can anyone offer any suggestions?

    • Best answer by andrewbailey

    Zeronet,

     

    A DDoS policy on the WAN interface allows you to limit port scans. I've found that to be useful.

     

    If I recall correctly the DDoS policy is applied early in the packet flow- essentially making it one of the more efficient approaches to limiting this type of undesirable scanning.

     

    The other advantage of the DDoS policy is that you can "quarantine" the attacker for any period of time. I use a relatively small quarantine time of 15 minutes- but that slows the attackers down enough to reduce the problem. That would also help with your management issue- essentially the quarantine just happens in the background. Once the quarantine time expires it is cleared automatically too (which may be useful for preventing your remote users being blocked).

     

    The downside is that a DDoS policy will take some tuning- the settings you use will depend on your environment, WAN speeds etc. But there are some good guides in the Fortinet documentation on how to do it.

     

    Hope that is useful.

     

    Kind Regards,

     

     

    Andy.

     

     

     

     

    2 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    November 28, 2019

    Depending on the circumstances, a local-in policy for udp/500 and udp(tcp?)/4500 with either whitelisting safe origin countries, or blacklisting rogue origin countries might mitigate the situation.

    I've compiled all countries into an address group for convenience, found here https://www.beneicke-edv.de/support/tools/#all_countries_addressgroup

     

    andrewbailey
    andrewbaileyAnswer
    New Member
    November 28, 2019

    Zeronet,

     

    A DDoS policy on the WAN interface allows you to limit port scans. I've found that to be useful.

     

    If I recall correctly the DDoS policy is applied early in the packet flow- essentially making it one of the more efficient approaches to limiting this type of undesirable scanning.

     

    The other advantage of the DDoS policy is that you can "quarantine" the attacker for any period of time. I use a relatively small quarantine time of 15 minutes- but that slows the attackers down enough to reduce the problem. That would also help with your management issue- essentially the quarantine just happens in the background. Once the quarantine time expires it is cleared automatically too (which may be useful for preventing your remote users being blocked).

     

    The downside is that a DDoS policy will take some tuning- the settings you use will depend on your environment, WAN speeds etc. But there are some good guides in the Fortinet documentation on how to do it.

     

    Hope that is useful.

     

    Kind Regards,

     

     

    Andy.

     

     

     

     

    zeronet
    zeronetAuthor
    New Member
    December 5, 2019

    Thank you both for the suggestions, extremely helpful!

     

    I ended up creating an address group with the ranges that were seen most often and adding a deny policy.  Right away, I seen activity on the policy.

     

    Additionally, I also setup a DDoS policy and used the documentation as a starting point: https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-firewall/Policy%20Configuration/IPv4%20DoS%20Policy.htm

     

    @ede_pfau - Do you see any performance hit when using the geo filtering?  To-date, about 50% of the malicious hits are from inside my country, so geo blocking would only cut down on some of the abuse.

    pentester
    pentester
    New Member
    September 7, 2024

    Any ideas on how to block port scans that use bypassing methods such as this page demonstrates?


    https://www.northit.co.uk/posts/bypassing-port-scan-blocking-firewalls/

    Terms & ConditionsAccessibility statement