summary of ports that are open by default

Hello all,

One of our customers did have a security audit and noticed that there are ports opened on the firewall which are not configured via a firewall policy. They want all ports that are not needed will be set to close.

I know the Fortigate Open Ports Diagram, but this doesn't cover all ports that are opened by default.

When you deploy a Fortigate vm (5.2.6) and only enable the webgui/ssh access and then execute the command 'diag sys tcpsock' you will notice ports that are not listed in the diagram:

0.0.0.0:[style="background-color: #ff0000;"]709[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:1000->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1001[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1002[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:1003->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1004[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1005[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1006[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:80->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1011[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1012[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:53->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:1013->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:22->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1014[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:23->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1015[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1016[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1017[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1018[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]2650[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:443->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1019[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]7900[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x2 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1020[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:541->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=0192.168.247.132:22->192.168.247.1:62950->state=estabilshed err=0 sockflag=0x1 rma=0 wma=2296 fma=5896 tma=0192.168.247.132:80->192.168.247.1:62936->state=time_wait err=0 sockflag=0x0192.168.247.132:80->192.168.247.1:62930->state=time_wait err=0 sockflag=0x0192.168.247.132:80->192.168.247.1:62931->state=time_wait err=0 sockflag=0x0192.168.247.132:80->192.168.247.1:62934->state=time_wait err=0 sockflag=0x0192.168.247.132:80->192.168.247.1:62935->state=estabilshed err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=0192.168.247.132:80->192.168.247.1:62927->state=time_wait err=0 sockflag=0x100

Does anyone has an overview that includes all ports?

 

Thanks and regards,

Ralph Willemsen

Arnhem, Netherlands