New Member

Question

Port 2000 and 5060 open by default (How to close)

Forum|Forum|8 years ago
November 27, 2017
15 replies
63096 views

Hi,

A pen test on our outside IP shows us that port 2000 (Cisco Skinny Clients (IP Phones)) and 5060 (Session Initiation Protocol).

We don't need those ports. And our security office wand to close these ports.

We are running on software version: v5.4.5

The configuration change we did to close port 5060:

conf global
config system session-helper
delete 13
end

And for port 2000 we used the following:

conf vdom
(vdom) # edit Firewall
# config voip profile
(profile) # edit default
(default) # config sccp
(sccp) # set status disable
(sccp) # end

But unfortunately this did not close the ports.

Does anyone has a suggestion to close these 2 ports.

I hope someone can help me. Thanks in advance.

Greetings Palermo

Iescudero

New Member

Hi there!

Maybe with a local-in policy you can achieve this:

config firewall local-in-policy

edit 1

set intf wan1

set srcaddr all

set dstaddr all

set action deny

set service TCP_5060

set schedule always

end

http://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-firewall-52/Security%20Policies/Local-In%20Policies.htm

Hope it helps!

emnoc

New Member

Have you looked at local-in policies but I wonder how & what open test did they do?

Palerm0Author

New Member

@Iescudero I`m gona test this on our test firewall Thanks.

But still. Fortinet is suggesting the commands i described above to close the helper ports. So i don`t understand why the ports are still open.

@emnoc Its just a nmap command from an external machine that does pen tests;

Discovered open port 2000/tcp on xxx.xxx.xx.xx

Discovered open port 5060/tcp on xxx.xxx.xx.xx

Thanks for your suggestion

Gr

Palermo

packetpusher

New Member

When you perform a network scan of any kind, i.e. netmap <WAN IP of your firewall>, do you get the same result as the pen test?

Palerm0Author

New Member

Hi, I found a solution to my problem.

the code i used in my initial post did not work with our software version. The support documentation is out-dated. We running on version 5.4.5.

To disable the SIP helper / ALG i used the following code

config system settings
set default-voip-alg-mode kernel-helper-based
end

Important is that you need to configure it on all the VDOM`s

A reboot is not necessary, Clearing the sessions worked for us:

diagnose sys session filter
diagnose sys session filter dport 5060
diagnose sys session clear
diagnose sys session filter dport 2000
diagnose sys session clear

It may help others :)

Greetings

Palermo

emnoc

New Member

Did you run a diag to look at active ports

e.g

diag ip udp list | grep 13C4

NOTE port numbers are in HEX value

Ken

jweill

New Member

I disabled SIP ALG but these ports still show as open on a 60D with firmware 5.6.3

marco_d

New Member

Palerm0 wrote:

But unfortunately this did not close the ports.
Does anyone has a suggestion to close these 2 ports.

I hope someone can help me. Thanks in advance.
Greetings Palermo

Hello my name is Marco,

i am looking for a solution for the same problem. But we have some IP weher we use that ports

so i am looking for a solution to block these ports for speacial ip´s. We are running 5.4.9 on a 240d

Thanks and regards

Marco

kk777

Explorer

I wanted to share my experience regarding disabling ports, specifically ports 2000 and 5060. It's important to remember that if you're using a scanner behind another Fortigate that isn't directly involved in the scanning, you need to take that into account and disable the necessary settings on it as well. I kept receiving information about an open port on the target Fortigate, but the issue was caused by the Fortigate behind which I was running the scan. It had the default-voip-alg-mode set to proxy. Once I disabled this setting, the problem was resolved. ;)

ZackInMA

Visitor III

This had me banging my head for a while. Thank you!

Sign up

Login with SSO

Login to the community

Login with SSO