Quote:
Originally Posted by northlandboy  Block everything except that which is explicitly allowed is the only sane approach. Blocking only specific ports is just stupid, and will not protect your network effectively.
Regarding dynamic traffic, you've got two options:
* Use Check Point or similar to perform a deeper inspection of the traffic, so that it is aware of what the dynamic traffic is, and only allows what's required
* Configure the application to use a restricted range of ports. With OpenView e.g., this is quite straightforward. |
What you stated in your first paragraph above is precisely what we are doing.
Can you expand on your other two points? We don't have OpenView therefore I imagine we can not restrict the application to a range of ports. Any other suggestions?
Thank-you for your assistance.