Firewalla does an Internal Port Scan ?

Follow

Mark

• July 24, 2020 13:15

Well my new firewalla gold arrived a few days ago and I installed it in router mode. So ISP Modem <> Firewalla <> AP/Switch <> Devices.

This afternoon my AntiVirus on the PC, out of the blue, began screaming that a Network Attack via Portscan was being done on my computer. Several ports were being scanned like port 84, 9666, 2107 etc... This PC that sits behind the gold.

Is this normal behavior of the firewalla gold ?

0

• 

  Firewalla

  • July 24, 2020 22:17

  Yes, the Gold/red/blue all does scan's to the network to detect services and also devices that are not on your DHCP table. 

  0

  Comment actions Permalink
• 

  Mark

  • July 25, 2020 08:25
  • Edited

  Thanks for the info as I was wondering if this was some kind of attack reconnaissance or the firewall itself...

  May I suggest that, if possible, there is an option to enable/disable this? If ever you lobby your product to businesses corporate environments, automatic non-requested active port scans are frowned upon and usually alerted to the IT Security Officer/IT Admin - maybe use passive scans?

  1

  Comment actions Permalink
• 

  Christian Huß

  • November 08, 2020 11:19
  • Edited

  Hey is there any chance to schedule these scans? With my business notebook i cant configure the Client AV Software. But my IT Department called me several times, that there is a device doing portscans on my Notebook. So i think if the portscan will run out of my business time the IT will not recognize it. Or i need to stop it. Thanks 4 help!

  0

  Comment actions Permalink
• 

  Mark

  • November 08, 2020 12:42
  • Edited

  There is now an option named "Device Port Scan" under features that enables/disables this. Seems to work for me, maybe it can help you too to switch it off at least.

   

  1

  Comment actions Permalink
• 

  Christian Huß

  • November 08, 2020 12:46

  Perfect. Thanks for this. Maybe in later versions its possible to switch it off per group or device. at first it helps. thanks mark.

  0

  Comment actions Permalink
• 

  Ivan Moore

  • December 17, 2020 21:46

  In the version I am running you can apply the port scan option to all devices or specified devices/groups. 

  0

  Comment actions Permalink
• 

  Firewalla

  • December 17, 2020 21:48

  @ivan, yes, in the current app's, we added the functions to limit the scan's.  The reason we did this is, some devices on the network are not properly implemented, when they see port scan's, they will just die ...  this function will enable you to not scan the "sensitive" devices.

  0

  Comment actions Permalink

Please sign in to leave a comment.