Skip to main content
kadey
New Member
December 23, 2019
Question

AWS Fortigate instance incommunicado...

I have a Fortigate instance in AWS that I cannot get to with ssh or https. It was accessible since creation (months), then all of a sudden it was not. I can ping it, and (by using nmap) can see that ports 22, 443, 500 and 4500 are accessible and listening. Security is wide open to this instance. Any ideas what could be wrong?

 

The console image shows the following:

 

System is starting...
Serial number is FGTAWS000133210D


FGTAWS000133210D login:
AWS instance-id: i-0133210d2e0c26da

    14 replies

    emnoc
    New Member
    December 23, 2019

    Have you check

     

    trusthost ?

    security-group?

     

    Ken Felix

     

    kadey
    kadeyAuthor
    New Member
    December 24, 2019

    Wouldn't the fact that I can scan the relevant ports mean there's nothing blocking the traffic?

     

    I looked at the flow logs for the WAN interface, and the traffic is being accepted ok.

     

    kadey
    kadeyAuthor
    New Member
    December 26, 2019

    I did more comprehensive scanning, and it's only finding tcp port 541 open.

     

    Port 541 is used by FortiManager. Could my FortiGate have been somehow put into remote management mode?

     

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT