Frotigate 100D v 5.2

Nabeel,

What do you mean with 1)? Open/Closed Ports? 

Ports for services on a FGT are set with the corresponding interface. 

This  goes for e.g. http(s) for Webinterface, ssh for cli or also FMGACCESS which you need if you use a FortiManager and some more.

Ports for Services not on the FGT are basically set via either VIP (Portforwarding)  or Policy. 

This can be checked from outside the FGT with any Portscanner like unix's nmap or yaps.

To 2)

the default services settings on a FGT for FGT's internal services are quite open. 

I am not sure if you want to be able to get to the webinterface from WAN Side of your FGT.

I usually only allow ssh coming from WAN (Internet). Https is only available on internal interfaces (Internal subnet for the shop or our admin vpn) and so is SNMP. Http is deactivated. From the rest I only have enabled FMGACCESS hence we use a FortiManager here but it also is only available via our admin-vpn. Rest is off on the interfaces.

Per Factory Defaut btw all internal physcial ports (Port1-x or Internal1-x depending on FGT Model) are one (virtual) switch that has 192.168.1.99 as ip and there is one policy that allows everything to everything and one that denies the rest. So you might have to change this to what you need.

ALso there is a dhcp server active on that switch btw.

hth

Sebastian