Skip to main content
kr151
kr151
New Member
October 10, 2012
Question

Hide Firewall OS version from scan

  • October 10, 2012
  • 3 replies
  • 4040 views
Hello, I have a question, is there a way to hide the visibility of OS version and other services on Fortigate. Actually a vulnerability report shows that it is possible through scan to obtain certain specific info, like OS version, Open Ports, etc... on the internet. Does anyone know of a way to actually hide that info. Thanks for your help!!!

    3 replies

    emnoc
    emnoc
    New Member
    October 10, 2012
    You have a few items to consider if you have anything open facing the untrusted internet, but to be honest I wouldn' t worry about my FortiOS version being detected 1: run WEBgui on a port that' s not-common 2: run ssh on a port that' s not-common 3: disable ident " set ident-accept disable" on each external interface
    TopJimmy
    TopJimmy
    New Member
    October 10, 2012
    ORIGINAL: emnoc 3: disable ident " set ident-accept disable" on each external interface
    other way around according to the knowledge base: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=11763&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=38514481&stateId=0%200%2038512846 For example, to disable ident responses on a network interface names port1, you would enter the following commands: config system interface edit port1 set ident-accept enable next end TCP 113 is closed.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    October 10, 2012
    Better still, don' t use admin access on the WAN port! Instead, create a dial-in IPsec VPN and enable administration from the internal interface. That really doesn' t take longer than 5 minutes, and the IPsec client is for free.
    ddskier
    ddskier
    New Member
    October 11, 2012
    That seems counter intuitive. Run " set ident-accept enable" to disable it? Is that a type-o in the KB? or is that really the correct setting?
    TopJimmy
    TopJimmy
    New Member
    October 11, 2012
    ORIGINAL: ddskier That seems counter intuitive. Run " set ident-accept enable" to disable it? Is that a type in the KB? or is that really the correct setting?
    I agree but that' s what it is. All the documentation (fundamentals handbook, admin handbook and CLI reference) say the same thing.
    Terms & ConditionsAccessibility statement