Checklist for a Port Being Opened

port Telnet Machine ACL

Checklist for a Port Being Opened

< !!! INTERNAL USE ONLY !!! >
Not for distribution directly to end user

Overview

This document provides a procedure for technical staff to test if a port on a server is opened and usable by an application.

Audience

Internal Information Technology Staff

Procedure

Start the procedure from the local machine drop-down menu.

Local Machine

Perform a “netstat -an” from a command line interface and see if the TCP or UDP port you are looking for is listening. If the port is not listening as expected, there is most likely a problem with your installation. Reinstall the application or enlist the assistance of the applications support team.

Perform a local firewall check.

The easiest way to see if a local firewall is interfering with your connection is to shut it down momentarily.

On Windows, open an Administrative PowerShell window and type “Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False” which should disable the firewall. When you are finished, run the same command with “-Enabled True” to re-enable the firewall.

On Oracle Linux servers, “service firewalld stop” and “service firewalld start” will stop and start the firewall locally.

Once you have confirmed the port is listening and the firewall is stopped, you should test from a local segment. For example, if you are on a Banner server segment, such as 10.21.41.x, you should run the test from a server whose IP address starts with those same numbers. See “Confirming the Port is Open Using Telnet” at the end of this document. If the port is listening and the firewall is Off, a connection should be made. If you turn the firewall back On and the port no longer connects, adjust your firewall rules appropriately on the local machine. If the port is listening while the firewall is Off and you can still not make a connection, you will need to contact your support vendor.

Checking the Current Segment and Banner ACL

Once you have checked the local machine, move the test to a machine that is not located on the same subnet that the server is located on (typically your office machine).

Run the same test and see if the connection works. If the servers are located on the Banner production (10.21.40.x) or test (10.21.41.x) subnets, contact Network Engineering and ask them to review the “deny_student” Access Control List (ACL). If the server is on the DMZ (10.1.x.x) subnet, contact Information Assurance and ask them to review the Cisco and the Palo Alto firewall logs. When contacting either of these teams, please make sure to include as much detail as possible, including the IP address of the server you are working with and what testing you have accomplished up to this point.

Checking off Campus

If all of these tests work and the port is supposed to be available from the outside world, contact Information Assurance and ask them to review the Cisco and Palo Alto firewall logs.

Confirming the port is open using Telnet

First, you must ensure that the Telnet client is loaded on your machine. Linux systems come with it installed by default. Windows systems need it to be added and you need to be an Administrator on the machine. For Windows servers, go to “Turn Windows features On or Off” in the control panel. Searching for it in the modern Windows OS’s will also bring it up.

Once you have a command prompt open, use the command “telnet <host> <port>"