Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a cisco ASA 5505 with three interfaces: Internal (100), DMZ (50) and External (0). The internal has a IPSEC VPN tunnel to my internal network

I couldn't log in to my domain because of all of the port restrictions and such. I tried monitoring the traffic through the interface, seeing what it's blocking and then unblocking those ports but even then it didn't work completely correctly

I finally just added a rule to permit any ip traffic from any network to any network on the internal interface and, of course, it worked fine

But is that good security practice? Should I be blocking ports on an interface that's internal and over a VPN with the highest security level?

share|improve this question
up vote 1 down vote accepted

It would be wise to only allow what is defined as acceptable traffic and block all others.

I know it can be a pain but you should be reviewing what goes through your router and be able to determine what should be permitted as "official" traffic. This may require some systematic work to determine the ports used by the technologies you currently have operating.

Consider this: If an internal system is compromised would it be able to send data out on a port that it would not normally use to any ip address?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.