Technical Tip: List of open ports due to UTM inspection in proxy
Description
This article describes why some ports are opened once traffic hits the firewall policy with UTM profiles in proxy inspection mode, even though they are closed on the server side.
Scope
Any supported version of FortiGate.
Solution
Topology.
Scenario A:
The user is protected by FortiGate and runs a port scan (for example, NMAP) against the server on the internet.
The `diagnose sys tcpsock` command lists all TCP ports on which the FortiGate is listening (listening sockets), along with the responsible processes.
However, the presence of a socket in "listen" state does not necessarily imply that the device is accepting external connections on those ports.
No UTM in proxy inspection mode or UTM in flow inspection mode:
Not shown: 993 filtered ports
PORT STATE SERVICE
53/tcp open domain
113/tcp closed ident
541/tcp open uucp-rlogin
1443/tcp open ies-lm
2000/tcp open cisco-sccp
5060/tcp open sip
8008/tcp open http
Not shown: 987 filtered ports
PORT STATE SERVICE
21/tcp open ftp
25/tcp open smtp
53/tcp open domain
80/tcp open http
110/tcp open pop3
113/tcp closed ident
115/tcp open msrpc
143/tcp open imap
541/tcp open uucp-rlogin
1443/tcp open ies-lm
2000/tcp open cisco-sccp
5060/tcp open sip
8008/tcp open http
Not shown: 993 filtered ports
Not shown: 982 filtered ports
PORT STATE SERVICE
21/tcp open ftp
25/tcp open smtp
53/tcp open domain
80/tcp open http
110/tcp open pop3
113/tcp closed ident
143/tcp open imap
443/tcp open https
465/tcp open smtps
541/tcp open uucp-rlogin
990/tcp open ftps
993/tcp open imaps
995/tcp open pop3s
1443/tcp open ies-lm
2000/tcp open cisco-sccp
5060/tcp open sip
8008/tcp open http
8010/tcp open xmpp
From v6.4 and above, the 'Proxy Option' changes to 'Protocol Option'. If the firewall policy uses the default Protocol Option with proxy-based inspection, the following ports will be shown as open when doing a port scan:
It is possible to create a custom protocol option to disable these port inspections.
When flow inspection is in effect, FortiGate will not send a (SYN ACK) packet to the client before receiving a (SYN ACK) packet from the server.
Note:
FortiGate does not respond to traffic destined to these internal ports, although the socket state indicates listening, unless these ports are configured or enabled for other purposes, such as FortiGate GUI administration or FTP Virtual IP configuration (In case of port 21 detected by the scanner).