Skip to main content
benslimen
Visitor III
June 14, 2023
Solved

Fortigate allows trafic to ports TCP 49152-65535 even though no policy is configured for the ports.

  • June 14, 2023
  • 1 reply
  • 6743 views

Hello,

I have a policy that allows trafic to microsoft related ports (attached image of the policy configured).

On the FortiAnalyzer, the logs show that this policy matches with an accept action for ports TCP 49152-65535 that are not allowed on the said policy (attached image of the log on FortiAnalyzer and the Policy Lookup done to verify that the ports are not allowed).

 

Is this a bug on the FortiGate or is this an intended behaviour from the FortiGate?

Thanks,Policy LookupPolicy LookupFAZ LogFAZ LogFirewall PolicyFirewall Policy

Best answer by abarushka

Hello,

 

Traffic can be allowed by expected sessions (i.e. DCE-RPC port 135).

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Session-helpers-and-expectation-sessions/ta-p/189938

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DCE-RPC-session-helper/ta-p/198374 (DCE-RPC session helper)

1 reply

abarushka
Staff
abarushkaAnswer
Staff
June 14, 2023