Skip to main content
Jennyjcuk
Jennyjcuk
New Member
December 10, 2019
Question

Block specific tcp/udp port

  • December 10, 2019
  • 1 reply
  • 16748 views

We have a student who i think is using a VPN which uses TCP/UDP 28298 because that's all I see in her Forward traffic reports. Also on O365 it shows me she's a risky user logging in from various different countries!

 

We have a FortiGate 300E running 6.2.2 Firmware.

Thanks,

Jenny

 

    1 reply

    Vishalv16
    Vishalv16
    New Member
    December 10, 2019

    hi, am not an expert but here what i suggest 1)you can create at service name custom_block_port in objects & security tab then in that service mention the port range for both TCP 28298-28298 & UDP 28298-28298, 2)create new deny policy mention & mention the particular service only in service that that we just created and move this policy at top. 3)Now every traffic goes to those ports will be denied as per policy.(i had tried to block UDP port 80 & 443 for google chrome it worked for me)

    Jennyjcuk
    JennyjcukAuthor
    New Member
    December 10, 2019

    Thanks @Vishalv16 I have created the custom block port and added it to a new deny policy but it's not blocked for the student i was monitoring still as she is an timed policy further down where it is allowed.  Not sure how that works, as you can't allow and block in the same policy!

    Vishalv16
    Vishalv16
    New Member
    December 10, 2019

    right you can't allow & block in same policy. did you move policy at the top as firewall read policy from top to bottom 1st policy will be taken into consideration & next to that even if its deny it will not block traffic as allow policy is above it in list can you share screenshot of your policy what you created  & service as well. Note: if you think its using an VPN  you can add application control filter to policy  then then block all the VPN application(proxy category) to use inside the network. Regards Vishal

    Terms & ConditionsAccessibility statement