Port 1720 open on F5 public virtual server

What are the results of?

 

nmap -O

 

and if you capture the Nmap scan in a tcpdump do you see the packets making it to bigip?

 

tcpdump -i 0.0:nnn -w /var/tmp/port1720.pcap host and host

 

Hi,

 

Which TMOS version do you have? Could you post your Virtual Servers configuration?

 

Just for curiosity I did the test in different versions of TMOS without this abnormal behavior in BIG-IP.

 

This is the behavior in my lab:

 

telnet f5labs.test.lab 1720

 

Connecting To f5labs.test.lab...Could not open connection to the host, on port 1720: Connect failed

 

nmap -sT -p 1720 f5labs.test.lab

 

Starting Nmap ... Nmap scan report for f5labs.test.lab ... Host is up.

 

PORT STATE SERVICE

 

1720/tcp filtered h323q931

 

Hi,

 

Is there a Check Point firewall between the internet and the F5, and is port 1720 (H323) used in the rule base as a custom service?

 

If have seen this kind of behavior with on of our customers. A telnet on port 1720 is accepted by the Check Point because Check Point wants to inspect the H323 traffic. Even if it is a custom service on the same port-number.

 

If there is a NAT rule, it seems like the F5 is accepting the connection, but in fact it is the Check Point.

 

Hope this helps.

 

Martijn.