Skip to main content
jefazo92
jefazo92
Explorer II
July 30, 2024
Question

Does deleting an entry in Services disable a service in Fortigate?

  • July 30, 2024
  • 3 replies
  • 2294 views

Hi, 

 

There are a number of services I would like to disable such as ldap and tftp. I found them listed in Policy & Objects - > Services. If I were to delete the entries there for thses services, would it delete them or would it just delete the entries but keep the services active?

3 replies

cravikumar
Staff
cravikumar
Staff
July 30, 2024

If you delete the services, you can't reference it under policy and objects but the services will still be active. Use local-in policy to block services.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-open-ports/ta-p/189671

    jefazo92
    jefazo92Author
    Explorer II
    July 31, 2024

    Thank you very much @cravikumar! 

      jefazo92
      jefazo92Author
      Explorer II
      August 26, 2024

      Hi @cravikumar, apologies but I should have asked you as well how I may check all the default services, protocols and ports which can be referenced and edited through local-in-policy. I want to block LLDP service and some time ago I found a post some time ago describing the command to find this but I think it might have been removed as I cannot find it any longer.

      SonaMuvv
      Staff
      SonaMuvv
      Staff
      August 26, 2024

      Hello,

       

      If you want to know what services can be edited in the local-in-policy, you can run the below command with a question mark and that will show you a list of services that you can use in localin-policy

      config firewall local-in-policy

      edit x  ---> local-in-policy id

      set service ?

       

      Also, I am attaching a documentation to disable LLDP globally and also on interface level.

      https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/311052/lldp-reception

      sw2090
      SuperUser
      sw2090
      SuperUser
      August 27, 2024

      in fact those are just objects. Their pure existance does not enable or disable anything. Plus I gues there are factory default objects you probably cannot delete.

      Actually Fortigates work the other way round: if you want a service to be enabled you have to create a policy for it (except from interface based ones but these can be enabled/disabed in the interface settings and do not need an object). Anything you did not explicitely enable will always be denied by policy #0 (implicite deny).

      Terms & ConditionsAccessibility statement