Close Cisco IOS TCP Ports 23, 2002, 4002, 6002, and 9002 from Network Ports Scanning

Just found my Cisco 1921 has same problem on ports 2002, 4002, 6002 and 9002, as described on this post.

Symptoms:

Some Cisco Cisco Routers (1900/2900 Series) are answering to the TCP connection attempts (replying SYN-ACKs for the SYN requests) upon TCP ports 2002, 4002, 6002, and 9002.

Some other routers are answering tcp port 23 (telnet).

I used http://ping.eu/port-chk/ to test those ports, ports 2002, 4002, 6002 and 9002 are opening on my CISCO1921 router :

R1#show control-plane host open-ports
Active internet connections (servers and established)
Prot Local Address Foreign Address Service State
tcp *:22 *:0 SSH-Server LISTEN
tcp *:23 *:0 Telnet LISTEN
tcp *:6002 88.198.46.51:58719 TCP Protocols ESTABLIS
udp *:123 *:0 NTP LISTEN
udp *:4500 *:0 ISAKMP LISTEN
udp *:161 *:0 IP SNMP LISTEN
udp *:162 *:0 IP SNMP LISTEN
udp *:1975 *:0 IPC LISTEN
udp *:57430 *:0 IP SNMP LISTEN
udp *:500 *:0 ISAKMP LISTEN

Solutions:

1. Solution for ports 2002, 4002, 6002 and 9002 will be same as the post mentioned before:

Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#line 2
Router(config-line)#transport input none
Router(config-line)#end
Router#

2. Solution for port 23:


R#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R(config)#class-map type port-filter match-any TCP23

R(config-cmap)#match port tcp 23

R(config)#policy-map type port-filter FILTERTCP23

R(config-pmap)#class TCP23

R(config-pmap-c)#drop   

R(config-pmap-c)#log

R(config)#control-plane host

R(config-cp-host)#service-policy type port-filter input FILTERTCP23

*Aug 15 16:31:29: %CP-6-TCP: DROP TCP/UDP Portfilter 88.198.46.51(57596) -> 61.16.203.24(23)
*Aug 15 16:31:30: %CP-6-TCP: DROP TCP/UDP Portfilter 88.198.46.51(57596) -> 61.16.203.24(23)