Skip to main content
r17
r17
Visitor III
October 3, 2024
Question

Telnet - non default port

  • October 3, 2024
  • 2 replies
  • 2832 views

 

Hi everyone,

I'm facing an issue with FortiGate Application Control. I have a profile configured to block all applications, including Telnet and Unknown traffic. The problem occurs when I test Telnet using the command:

 

 
telnet pop.gmx.net 110

Instead of being blocked, this connection goes through, and in the logs, it gets categorized as "Unknown" rather than Telnet. Even though I’ve set Application Control to block Unknown traffic, it still allows the connection.

Configuration:

  • Application Control: Blocking all traffic, including Telnet and "Unknown".
  • Application Default: Enabled.
  • Logging: Shows the traffic as "Unknown" instead of Telnet.

The Issue:

Telnet over port 110 (normally used for POP3) is not getting blocked or recognized as Telnet—it’s instead showing up as "Unknown" but still not being blocked.

Questions:

  1. Why is Telnet over port 110 being classified as "Unknown" instead of Telnet?
  2. Is there any way to force FortiGate to correctly recognize and block Telnet traffic on non-standard ports?
  3. Has anyone experienced similar issues, and how did you resolve it?

Thanks for your help!

FLorian

 

 

config:

config application list
edit "TEMP_PERIMETER"
set enforce-default-app-port enable
set unknown-application-action block
set unknown-application-log enable
config entries
edit 1
set application 16091
next
edit 2
set category 2 3 5 6 7 8 12 15 17 21 22 23 25 26 28 29 30 31 32
next
edit 3
set action pass
next
end
next
end

 

config firewall policy
edit 1071741840
set name "TEST"
set uuid 9b0f2c98-7408-51ef-afa2-775104cae6d8
set srcintf "Z_INSIDE"
set dstintf "virtual-wan-link"
set action accept
set srcaddr "HOST_TEST_WIN007"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "TEMP_DEEP-INSPECTION"
set av-profile "TEMP_AV_default"
set webfilter-profile "TEMP_Web-Filter"
set dnsfilter-profile "TEMP_DNS-Filter"
set file-filter-profile "TEMP_Basic"
set ips-sensor "TEMP_IPS_strict"
set application-list "TEMP_PERIMETER"
set logtraffic all
set nat enable
set ippool enable
set poolname "NAT-POOL_INTERNET"
next
end

2 replies

AEK
SuperUser
AEK
SuperUser
October 4, 2024

Hi r17

As per my knowledge when you do "telnet host 110" the telnet tool just tries to open a TCP connection, so FGT App Ctrl doesn't have enough info to recognize this as telnet protocol connection, until there are some specific traffic signature that reveals to FGT which app traffic is flowing.

AEK
    r17
    r17Author
    Visitor III
    October 4, 2024

    But based on your input, I’ve created a custom application signature:


    F-SBID( --attack_id 9626; --name "Block-Unknown-TCP-Ports"; --protocol tcp; --dst_port 1:65535; --app_cat 32; )

    After adding this to Application Control, I successfully got a block for the traffic.

     

    Unbenannt.png

    However, I noticed something strange: a new category appeared in the Application Control list with the same name as the default "Unknown" category. It looks like the custom signature created another entry for "Unknown" traffic. Does this seem normal to you? It feels a bit unusual to me.

    Thanks again for your insights!

    r17
    r17Author
    Visitor III
    October 4, 2024

    Hi AEK

    I understand that the Telnet tool is just opening a TCP connection and that there might not be enough info initially for FortiGate to recognize it as a Telnet protocol connection.

    However, shouldn't Application Control still categorize it as "Unknown" traffic since it's not identified as Telnet? And if Unknown traffic is set to be blocked, shouldn't it prevent the connection from going through regardless of the protocol?

    Thanks for your input!

    AEK
    SuperUser
    AEK
    SuperUser
    October 4, 2024

    Actually I'm not certain how app ctrl works in detail, but I guess this "unknown" you see is somehow "not enough info to make decision". And I think when there is enough traffic to decide, and FG finds nothing in its app DB that match the traffic signature, here it is decided that this traffic has been identified as actually "unknown", and here it should be blocked.

    Here I'm just talking as by my understanding. Hope some more experienced member can inform us further.

    AEK
      Terms & ConditionsAccessibility statement