Skip to main content
martyyy
Explorer III
August 19, 2024
Question

Closing port 2000 and 5060 for a single VDOM

We have a customer who uses a VDOM on a shared Fortigate appliance. The customer is concerned that ports 2000 and 5060 are showing open when he scans his IP for open ports. I believe this is related to SIP ALG. Firewall policies will not close the ports. We only want to close this port for the one VDOM, as we are not sure if other customers are using services related to these ports.

 

I've already done the configuration below on item 1-2. 

1. This disables SIP-ALG, and will use SIP session helper:
config system settings
set default-voip-alg-mode kernel-helper-based
end

2. If having Multi-VDOM, disable SIP-ALG on all respective VDOM :
config vdom
edit VDOM-A
config system settings
set default-voip-alg-mode kernel-helper-based
end
next
edit VDOM-B
config system settings
set default-voip-alg-mode kernel-helper-based
end

 

3. config sys session-helper
delete 13
end

 

I can see that `config sys session-helper` will work on the global VDOM; however, we need to ensure that this change does not affect other VDOMs. It seems that command is not available at the VDOM level.

 

Will this  command on item 3 will affect the other VDOM's?

 

Reference: How to close port TCP/UDP 5060 and TCP 20... - Fortinet Community

 

TIA :) 

1 reply

jintrah_FTNT
Staff
Staff
August 19, 2024

Hi,

The session helpers are global and applies to all the vdoms. Therefore, you can use local in policy to restrict traffic to required vdoms, please see Local-in policy | FortiGate / FortiOS 7.6.0 | Fortinet Document Library

 

Best regards,

Jin

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT