How to block 1723 port incoming request ?

Hi,

To block a specific port on a FortiGate device, follow these instructions:

1. Access the FortiGate web interface.
2. Go to Policy & Objects > IPv4 Policy.
3. Select Create New to set up a new firewall policy.
4. Adjust the following settings:
   • Source Interface: Choose the interface where the traffic originates.
   • Destination Interface: Pick the interface where the traffic is intended to go.
   • Source Address: Enter the source IP address or range.
   • Destination Address: Specify the destination IP address or range.
   • Service: Select the particular service or port you want to restrict, in your case port 1723.
   • Action: Set the action to Deny to block the traffic.
5. Save the new firewall policy.

I hope i answered your question .

Best regards.

If it's traffic to FGT's interfaces, you need to do it in local-in policy. For 7.4 or before, you need to use CLI.
https://docs.fortinet.com/document/fortigate/7.4.5/administration-guide/363127
For 7.6, you can use GUI in addition to CLI method.
https://docs.fortinet.com/document/fortigate/7.6.0/new-features/308650/gui-support-for-local-in-policies

Toshi

You can configure the following:

config firewall service custom
edit "Port-1723"
set tcp-portrange 1723
set udp-portrange 1723
next
end

config firewall local-in-policy
edit 1
set intf "port1" <- Your public interface or any
set srcaddr "all"
set dstaddr "all"
set service "Port-1723"
set schedule "always"
next
end

Then you can confirm if the traffic on that port is being blocked using:

diagnose sniffer packet any 'port 1723' 4

Hope this helps

Hello @Ganbayar  ,

Thank you for contacting the Fortinet Forum portal.

After verifying the steps suggested by  @FortiArt  and @AEH make sure to enable the "set match-vip enable" firewall policy if you have any Virtual IP configured refer to below article :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LAN/ta-p/189641

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.