When the Cisco ESA is configured to use Centralized Message Tracking, which default port is used between the device and the Cisco Security Management Appliance?

Question

Options

• Aport 53/UDP
• Bport 80/UDP
• Cport 23/TCP
• Dport 25/UDP
• Eport 22/TCP

• A
  5% (1)
• E
  95% (20)

Explanation

SSH (port 22/TCP) is the correct answer because the Cisco ESA uses SSH to securely transfer message tracking log files to the Cisco Security Management Appliance (SMA), enabling centralized visibility across multiple ESA devices. Port 53/UDP is reserved for DNS lookups and has no role in appliance management communication. Port 80 is an HTTP port but uses TCP, not UDP, and is a web interface port rather than a secure device-to-device transport. Port 23/TCP is Telnet - an insecure, largely deprecated protocol that Cisco avoids for appliance communication. Port 25/UDP is a trick entry since SMTP uses port 25 over TCP, not UDP, and SMTP is for mail transport between mail servers, not SMA tracking data.

Memory tip: Think "Secure SMA Handoff = SSH = 22/TCP." Any time Cisco appliances need to securely pass data between managed devices, SSH (22/TCP) is the go-to transport - the same port you'd use to log into the box directly.

No community discussion yet for this question.