Technical Tip: How to create custom service port in FortiGate from GUI and add on firewall policy

mpeddalla · ‎11-12-2023

Description

This article describes how to create custom port services from GUI and how to add them to firewall policy when there is a requirement to use.

Scope

FortiGate.

Solution

As shown in the image below, select policy & object and choose Services option:

Select the 'Create New' option that brings to the below screen. There are different options like TCP, UDP, SCTP protocol type, or ICMP and IP as well.

For a more detailed explanation, refer to the following document:

Configure custom services.

It is also possible to create a new category by selecting 'Create' if the category creating is not specified. As shown in the below pictures, it is possible to give any name.

In the below example, a test service is created for TCP/UDP custom port 2000 to 2500 by choosing the test category that was created in an earlier example. In this scenario, whichever port/protocol is required and created as per requirements.

While creating the custom service, user should be very careful and should not select 'Specify Source Ports' until unless the originated traffic is flowing with fixed source and destination ports, by mistake user select this and even though the above custom service is allowed on respective firewall policy and still the traffic does not allow due to source port does not match and the traffic will hit implicit deny policy and traffic will be dropped.

When the custom service is enabled with 'Specify Source Ports' then it would like below

config firewall service custom
    edit "test"
        set category "test"
        set tcp-portrange 2000-2500:2000-2500 1000-1500:1000-1500
    next
end

Once the custom service is created, it is possible to add the custom port under the firewall policy, the test policy is used to add the current test port.