Technical Tip: How to allow SSL on port 559 (Changing the Core list port from 555 to 559)

Apply the commands below using PowerShell on any one Windows collector agent to verify on which port the Core is listening:  
 

Test-NetConnection <Core IP Address> -Port 559 -informationLevel Detailed
Test-NetConnection <Core IP Address> -Port 555 -informationLevel Detailed

SSH to the Core and run the following commands to verify on which port the Core is listening:   
 

netstat -an | grep 555
netstat -an | grep 559

curl -v telnet://localhost:555
curl -v telnet://localhost:559

Data is never sent from the collector to the core in clear text. All data is being sent over the proprietary binary protocol, which is responsible for encrypting the traffic on port 555. The reason for introducing SSL encryption is for highly regulated industries and customers, where standard encryption protocols are mandatory for any application. 

The following are the steps to enable an SSL listener on Core over port 559: 
 

1. SSH to the Manager and stop the service using the following command:

fortiedr stop

2. Run the following command:

vi /opt/FortiEDR/webapp/application.properties

3. Change the below key value to true: 

core.configuration.ssl.enable=true 

4. Save it using the following command:

:wq! 

5. Start the service:

fortiedr start
 

6. SSH to the core and stop the service using the command:

fortiedr stop

7. Run the following:

vi /opt/FortiEDR/core/Config/Core/CoreBootstrap.jsn 

8. Change the following key value from 555 to 559

"GatewaySslAddress":"[CORE's external IP]:559" 

9. Save it using this command:

:wq!

10. Run the following:
    
    vi /opt/FortiEDR/platform/conf/platform.conf
    
    
11. Change the following line from port 555 to 559:
    
    core_port = 559
    
    
12. Save using the command:
    
    :wq!
    
    
13. Start the service:
    
    fortiedr start
    

14. Verify that the core service is up and running:
    
    fortiedr status
     
15. Open the port in the firewall:

firewall-cmd --add-port=559/tcp 

Note:

A certificate is required on the Core to make communication work from Collector to Core over SSL.