Skip to main content
chrispaesano
chrispaesano
New Member
June 5, 2015
Question

Disabling Port 8010

  • June 5, 2015
  • 3 replies
  • 53570 views

Hello,

 

I'm failing a PCI Compliance scan due to port 8010. In my research I found that this port is used for Web Override.

 

60D Firmware 5.0.11

 

 

I've entered the command:

 

config webfilter fortiguard

set close-port enable

 

According to an article I found here: http://kb.fortinet.com/kb/documentLink.do?externalID=FD33190

 

this should stop the Fortigate from listening on both of those ports. My device actually isn't listening on port 8008 no matter what I change that setting to but it also doesn't stop it from listening on port 8010. Any ideas?

 

I'm on with support right now and I'll post the answer once I'm done.

    3 replies

    chrispaesano
    chrispaesanoAuthor
    New Member
    June 5, 2015

    So far I've learned that the FortiClient EndPoint Registration is listening on port 8010. I'm still trying to figure out how to disable it. Hopefully Support will get it before I do. :)

    chrispaesano
    chrispaesanoAuthor
    New Member
    June 5, 2015

    The fix was to create a local-in-policy to block the port. It didn't make sense to reconfigure the port for forticlient-reg-port because it would have caused us to have to change xml files for the forticlients.

    rpmadathil_FTNT
    Staff & Editor
    rpmadathil_FTNT
    Staff & Editor
    June 11, 2015

    Hi Christian, TCP ports 8008 and 8010 are used for the FortiGuard block pages as well as the FortiGuard override pages. So if you use this ports, you may encounter this type if issue which is expected. So the solution is to change the override ports; You can view the current settings using the below commands #show full webfilter fortiguard config webfilter fortiguard     set ovrd-auth-port-http 8008 <<<<     set ovrd-auth-port-https 8010 <<<      To change the port number, you can use this commands; config webfilter fortiguard set ovrd-auth-port-http xxxx //change to different unused port for ex 58000. set ovrd-auth-port-https yyyy // change to different unused port for ex 58001. end

    mike_dp
    mike_dp
    New Member
    March 3, 2017

    Is there a way to close those ports but still have the Replacement messages showing correctly?

     

    We don't use the overide option so I tried to change the ports to 443 (that port has to be open anyway) but I can't in 5.4.4.

     

    I just want to close ports 8008 8010 and 8020 but still have the replacement messages for blocked pages or apps.

    Arcruz
    Arcruz
    New Member
    August 18, 2018

    Hi 

    These ports (8010 and 8020) are used by the Web Filter profile. If you have an equipment added to a policy and that policy have a Web Filter profile added, these ports will appear on the port scans.

     

    What can you do? 

     

    NOTE: MAKE A FULL BACKUP BEFORE!!!!

    [ul]
  • Create a policy without Web Filter and add the equipments to it.
  • if you need the web filter, disable port 8010 and 8020 from the command windows on the Fortinet by using these commands:[ul]
  • config global config webfilter fortiguard set close-ports disable end end[/ul][/ul]

    You can also look on the knowledge base of how to enable strong encryption, but this option will make your equipment CPU stress.

    • Terms & ConditionsAccessibility statement