I have a cisco ASA 5505 with three interfaces: Internal (100), DMZ (50) and External (0). The internal has a IPSEC VPN tunnel to my internal network

I couldn't log in to my domain because of all of the port restrictions and such. I tried monitoring the traffic through the interface, seeing what it's blocking and then unblocking those ports but even then it didn't work completely correctly

I finally just added a rule to permit any ip traffic from any network to any network on the internal interface and, of course, it worked fine

But is that good security practice? Should I be blocking ports on an interface that's internal and over a VPN with the highest security level?


It would be wise to only allow what is defined as acceptable traffic and block all others.

I know it can be a pain but you should be reviewing what goes through your router and be able to determine what should be permitted as "official" traffic. This may require some systematic work to determine the ports used by the technologies you currently have operating.

Consider this: If an internal system is compromised would it be able to send data out on a port that it would not normally use to any ip address?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.