Question
How to Shutdown " User authentication for policy override"
I' ve got a weird situation that I hope somebody can help me with. For some reason when scanning a target on our network for vulnerabilities (using the analyzer or a nessus host), my FortiGate 800 cluster responds for the target on port 8008 so it looks like the target host has some service running on port 8008. I' m scanning from the internet network to a host in the DMZ. Here is the source that it responds with:
<head> <title>Web Filter Block Override</title> </head> <body> <div style=" text-align: center;" ><img src=" http://xxx.xxx.xxx.xxx/logo1.gif" ><img src=" http://xxx.xxx.xxx.xxx/logo2.jpg" > </div> <font size=" 2" > <table style=" width: 100%;" > <tbody> <tr> <td colspan=" 2" style=" text-align: center; background-color: rgb(35, 83, 147);" ><font color=" #ffffff" ><b>Web Filter Block Override</b></font></td> </tr> <tr> <td colspan=" 2" ><br> <br> You have been granted override privileges for this website due to your job function. You can enter your username and password here to gain immediate access to the blocked web-page.<br> <br> </td> </tr> <tr> <td colspan=" 2" align=" center" ><font color=" #FF0000" >Invalid or missing protection profile ID in request.</font></td> </tr> </tbody> </table> <br> <hr><br> </font> </body> </html>^MAccording to Traffic Types and TCP/UDP Ports used by Fortinet Products port 8008 is used for " authentication for policy override of HTTP traffic" . Since I don' t allow overrides, I' m wondering how to get it to close that port.
