When a NMAP scan is performed to the port on SRX, SSH, BGP and several other ports shows open even though there is a firewall filter to block the traffic on the ports.

nmap 1.1.1.1

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-16 09:13 UTC

Nmap scan report for 1.1.1.1

Host is up (0.030s latency).

Not shown: 997 closed tcp ports (reset)

PORT STATE SERVICE

22/tcp open ssh

179/tcp open bgp

2000/tcp open cisco-sccp

affected device ssh test result: 

ssh 1.1.1.1

Connection closed by 1.1.1.1 port 22

Expected result:

ssh 2.2.2.2

^C

SSH to <ip-address> of the SRX:

ssh 1.1.1.1

Connection closed by 1.1.1.1 port 22

• The firewall filter configuration looks fine and we were able to see the Default-Deny-counters getting incremented.

The rule on the PFE were reviewed and configuration was good.

• The connection using ssh -v was tested and for the device with the issue we could see the following below and device which are working as expected doesn't show any connection:

openSSH_9.6p1 Ubuntu-3ubuntu13.11, OpenSSL 3.0.13 30 Jan 2024

debug1: Reading configuration data /root/.ssh/config

debug1: /root/.ssh/config line 1: Applying options for *

debug1: Reading configuration data /etc/ssh/ssh_config

debug1: Reading configuration data /etc/ssh/ssh_config.d/clab-.conf

debug1: /etc/ssh/ssh_config line 21: Applying options for *

debug1: Connecting to 1.1.1.1 [1.1.1.1] port 22.

debug1: Connection established.

debug1: identity file /root/.ssh/id_rsa type 0

debug1: identity file /root/.ssh/id_rsa-cert type -1

debug1: identity file /root/.ssh/id_ecdsa type -1

debug1: identity file /root/.ssh/id_ecdsa-cert type -1

debug1: identity file /root/.ssh/id_ecdsa_sk type -1

debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1

debug1: identity file /root/.ssh/id_ed25519 type -1

debug1: identity file /root/.ssh/id_ed25519-cert type -1

debug1: identity file /root/.ssh/id_ed25519_sk type -1

debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1

debug1: identity file /root/.ssh/id_xmss type -1

debug1: identity file /root/.ssh/id_xmss-cert type -1

debug1: identity file /root/.ssh/id_dsa type -1

debug1: identity file /root/.ssh/id_dsa-cert type -1

debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11

kex_exchange_identification: Connection closed by remote host

Connection closed by 1.1.1.1 port 22

# ssh -v 2.2.2.2

OpenSSH_9.6p1 Ubuntu-3ubuntu13.11, OpenSSL 3.0.13 30 Jan 2024

debug1: Reading configuration data /root/.ssh/config

debug1: /root/.ssh/config line 1: Applying options for *

debug1: Reading configuration data /etc/ssh/ssh_config

debug1: Reading configuration data /etc/ssh/ssh_config.d/clab-.conf

debug1: /etc/ssh/ssh_config line 21: Applying options for *

debug1: Connecting to 2.2.2.2 [2.2.2.2] port 22.

^C

• Monitor traffic interface doesn't show any incoming connections getting opened for the hosts that we tested.

• Firewall filter to block ssh connection for testing with log and count.

set firewall family inet filter RE_FILTER term SSH_BLOCK from protocol tcp

set firewall family inet filter RE_FILTER term SSH_BLOCK from destination-port ssh

set firewall family inet filter RE_FILTER term SSH_BLOCK then count discard.ssh 

set firewall family inet filter RE_FILTER term SSH_BLOCK then log

set firewall family inet filter RE_FILTER term SSH_BLOCK then count

set firewall family inet filter RE_FILTER term SSH_BLOCK then discard

• We could still see the SSH Key exchange between the devices.
• Further, it was identified to be a conflict with the IP duplication in the network that is triggering these messages, post fixing the IP duplication, the port open messages were not seen any more.