Illumio Community Hub

 View Only
Back to discussions
Expand all | Collapse all

something misconfigured or I can see any port scanning being blocked? we're nmaping from a source, trying to figure why it's not showing as blocked under view traffic

  • 1.  something misconfigured or I can see any port scanning being blocked? we're nmaping from a source, trying to figure why it's not showing as blocked under view traffic

    Posted 10-23-2020 20:10


    #General


  • 2.  RE: something misconfigured or I can see any port scanning being blocked? we're nmaping from a source, trying to figure why it's not showing as blocked under view traffic

    Posted 10-23-2020 21:01

    Hi Thomas,

    I assume you are not seeing the traffic at all, as opposed to the traffic showing as permitted when there are no rules in place. If you only have the VEN installed on the destinations of the scans (not the nmap source), and the destinations are Windows, no traffic will be reported for any flows to destination ports the server has no process/service listening on. Obviously that would not explain every connection from the scan, including anything destined for Linux systems. I would suggest opening up a case with Illumio Support to fully explain what you are seeing.

     

    Pete



  • 3.  RE: something misconfigured or I can see any port scanning being blocked? we're nmaping from a source, trying to figure why it's not showing as blocked under view traffic

    Posted 10-24-2020 23:07

    The other possible reason you are not seeing traffic reported as blocked will depend on the mode the VEN is in. If the destination VEN is in build or test mode that traffic will be reported as potentially blocked in explorer and not as blocked. If the destination is in idle mode this traffic will be reported as unknown or potentially blocked depending on the PCE version you are running. Only in enforced mode will the traffic report as blocked.



Related Content