Skip to main content
BusinessUser
BusinessUser
Explorer
September 29, 2023
Solved

TCP port 179 is open in firewall

  • September 29, 2023
  • 7 replies
  • 38513 views

Why is tcp port 179 open in firewall even though BGP is not used?

Because it is scanned as being open.

Is there any way to disable it?

Best answer by nweckel

Let's consider this topology:
172.16.1.1 ------ [LAN1|FGT|LAN2] ----- 192.168.1.1
LAN1 IP address: 172.16.1.2

You can block ping from 172.16.1.1 to 192.168.1.1 using firewall policy with srcintf LAN1 and dstintf LAN2.
But to block ping from 172.16.1.1 to 172.16.1.2, you need a local-in policy.

Easy example: In GUI navigate to Network> Interface. Edit an interface and allow administrative access ping.
This simply creates a local-in policy allow for ping on this interface.
You can display local-in policies in GUI in System> Feature Visibility.
If you don't allow administrative access ping on the interface: default local-in policy is used which is action=drop.

7 replies

nweckel
Staff
nweckel
Staff
September 29, 2023

Hello! You can block incoming traffic with local-in policies:

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/363127/local-in-policy

You can define incoming interface, protocol, port... And allow or block the traffic matching your settings.

    BusinessUser
    BusinessUserAuthor
    Explorer
    September 29, 2023

    Why is tcp port 179 open in firewall even though BGP is not used?

    hbac
    Staff
    hbac
    Staff
    September 29, 2023

    Hi @BusinessUser,

     

    Do you have BGP configured on the FortiGate? Do you have any VIP/Virtual server for port forwarding on TCP 179?

     

    Regards,

    BusinessUser
    BusinessUserAuthor
    Explorer
    October 7, 2023

    There is bgp enabled to communicate with the ISP router.

    However the security team is unhappy that port 179 is open to all.

    So should i use a local in policy or a firewall policy?

    Why is port 179 open to all in the first place?

    mle2802
    Staff
    mle2802
    Staff
    September 29, 2023

    Hi @BusinessUser,
    Please refer to this article for more detail "https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-close-BGP-port-179-with-Local-in-policy/ta-p/198642"

    Regards,
    Minh

    BusinessUser
    BusinessUserAuthor
    Explorer
    October 7, 2023

    Hi All,

    I need help.

    There is bgp enabled to communicate with the ISP router.

    However the security team is unhappy that port 179 is open to all.

    So should i use a local in policy or a firewall policy?

    Why is port 179 open to all in the first place?

    esalija
    Staff
    esalija
    Staff
    October 7, 2023

    Hi,

    Please follow the KB for block the port 179 with local-in policy - https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-close-BGP-port-179-with-Local-in-policy/ta-p/198642

    Best regards,

    Erlin

    BusinessUser
    BusinessUserAuthor
    Explorer
    October 7, 2023

    still doesnt answer the question

     

    what is the difference between using local in policy or a firewall policy?

    Why is port 179 open to all in the first place?

    esalija
    Staff
    esalija
    Staff
    October 7, 2023

    Hi,

    Here you can find the doc for the Firewall Policy -  https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/656084/firewall-policy

    Local-in Policy - https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/363127/local-in-policy

    Port 179 is open by default - https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/895321/view-open-and-in-use-ports

     

    Best regards,

    Erlin

    BusinessUser
    BusinessUserAuthor
    Explorer
    October 7, 2023

    Ok so will putting a firewall rule instead of a local in policy solve the problem?

    Using firewall policy in the GUI is "better" than using the CLI since we can keep track of what is going on.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 7, 2023

    You can test it yourself and see it won't work. Because regular FW policies are for traffic coming in one interface and going out to the other interface on the FGT. Those BGP packets are destined to the FGT itself not going out to any interface. Only local-in-policy can block them, just like blocking VPN or hack attempts to the FGT.

     

    Toshi

    megumi35
    megumi35
    New Member
    October 8, 2023

    I also have just noticed Port 179 is open after running the ShieldsUp test. I have one port closed and Port 179 open, when previously everything was stealth.

    I have a Raspberry Pi running Home Assistant and would like to know what is actually using this. Everything else I see is a very vague generic description of 179 and BGP.

    Terms & ConditionsAccessibility statement