CSN Number: 03092101 Date: 09.21.2003
Submitted by: Gordon Daugherty
   
 
Testing Proper Firewall Port Configuration for the ALG Proxy Servers
 
Emblaze-VCON Product: SecureConnect
Non-Emblaze-VCON Product:  
 
Problem Description:
After configuring the firewall for use by the ALG Proxy Servers, are there ways of testing to see if the ports are opened properly?
 

Resolution:
Yes. First, a telnet command can be used for each port that was opened to see if the connection is allowed. The telnet command can be issued from the ALG Proxy on the LAN side towards its counterpart on the WAN side. This can only be used to test the TCP port (the first of the 3 default ports), but not the UDP ports. The default TCP port used by the ALG Proxy Server is 6000. So a command might look like TELNET 192.100.100.101 6000. If the Telnet session opens, then the firewall rule is probably OK. The Telnet window will likely not show any data, but the test is to see if it successfully establishes a basic Telnet session through the firewall.

Another test uses the NETSTAT command. Similar to the TELNET method, it will help test the TCP port but not the UDP ports. The NETSTAT command actually shows which TCP ports are actively connected. The result of the command will show "established" for connected ports. From the LAN proxy system, issue a NETSTAT command and look for the indication next to default TCP port 6000.

Similarly, a NETSTAT -A command can be used to show the ports that are actively awaiting an incoming connection. The result will be "Listen" next to any such TCP ports. UDP ports awaiting incoming connections will also be listed, but with no state indication next to them.

 
Related Notes or Documents:
none
 
Back