FGT Local In Policy Allows UDP 1144 and 3799 for all ports - Details?

FYI, I contacted Fortinet and got the details on these open ports.  Here's a recap of the situation, the use of the ports, and the security concern.

With a FortiGate 300D (or any FGT) with v5.4.1, turn on the feature to display Local In Policy for the GUI.

Now, local in policy shows UDP 1144 and UDP 3799 as allowed for all interfaces, including wan interfaces.

There is no documentation for these services, and it appears there is no way (through the GUI) to block them.

The security issue is that it appears these ports are left open for ALL interfaces, internal and external, regardless of the FGT’s configuration.  

TAC told me that the ports' are used for:

- UDP port 1144 for AeroScout Mobileview and its communication to our FortiAPs. - UDP port 3799 for Radius Dynamic Authorization/Change of Authorization

Given those uses, you would think that not using those features would leave the ports closed, but that is not the case.  For example: - My current configuration has no RADIUS accounting on any interface, and no external (FortiCloud/FortiManager) management so UDP 3799 shouldn't be open on any ports, much less my wan ports, but it is open. - My current configuration is not (yet) set up to work with any FortiAP's (no CAPWAP on any interface, no cloud management of FortiAP's), so UDP port 1144 shouldn't be open on any ports, much less my wan ports, but it is open.

I could see how these ports could be open for certain interfaces IF I enabled external RADIUS or cloud management, or cloud management of FortiAPs, but they really shouldn't be open by default. Having them both open and undocumented is dangerous.

I've passed on the following new feature requests to Fortinet:

1. At a minimum, these ports should be documented in the list of what ports and protocols the FortiGate uses (http://docs.fortinet.com/...-ports-and-protocols). 2. Do not have UDP 1144 and UDP 3799 open by default on all ports. Expose these services in the GUI, under Network>Interface>Administrative Access, so that only when the FortiOS GUI shows the appropriate Administration Access setting does the Interface have these ports open.

With the current design, a FortiGate user has no documentation telling them about these ports, and the default configuration of the GUI (with the Local In Policy feature turned off) doesn’t show them these ports are open.

It looks like the only way to block these ports is with the CLI’s local-in-policy.

I'll post here if I get new information on this.