Technical Tip: Interpreting TCP Ports FortiGate Listens On from the Output of diagnose sys tcpsock

[vpalli]

Description	This article describes the purpose of the various open TCP sockets that FortiGate listens on, as shown in the output of the diagnose sys tcpsock command, and determines whether FortiGate responds to traffic directed to those listening ports.
Scope	FortiGate.
Solution	The command 'diagnose sys tcpsock' only lists the the TCP socket information and the listed ports are the socket ports. FortiGate# diagnose sys tcpsock 0.0.0.0:10400->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35053 process=206/authd 0.0.0.0:10401->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33870 process=328/authd 0.0.0.0:10402->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=24433 process=329/authd 0.0.0.0:10403->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=21499 process=330/authd 0.0.0.0:10404->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33893 process=331/authd The ports (10400, 10401, 10402, 10403, 10404) are internal to FortiOS for redirecting captive portal authentication requests of TELNET connections to authd daemon. 0.0.0.0:10500->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35059 process=206/authd 0.0.0.0:10501->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33876 process=328/authd 0.0.0.0:10502->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33909 process=329/authd 0.0.0.0:10503->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=36868 process=330/authd 0.0.0.0:10504->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33899 process=331/authd The ports (10500, 10501, 10502, 10503, 10504) are internal to FortiOS for redirecting SAML-based authentication requests of FortiClient remote access dialup IPsec VPN clients to authd daemon. SAML authentication traffic will first be received on the actual port configured in the system before being internally redirected to the above TCP ports. config system global     set auth-ike-saml-port <integer> end 0.0.0.0:10000->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35057 process=206/authd 0.0.0.0:10001->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33874 process=328/authd 0.0.0.0:10002->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33907 process=329/authd 0.0.0.0:10003->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=36866 process=330/authd 0.0.0.0:10004->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33897 process=331/authd The above TCP ports (10000, 10001, 10002, 10003, 10004) are internal to FortiOS for redirecting captive portal authentication requests of HTTP connections to authd daemon. 0.0.0.0:10100->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35058 process=206/authd 0.0.0.0:10101->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33875 process=328/authd 0.0.0.0:10102->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33908 process=329/authd 0.0.0.0:10103->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=36867 process=330/authd 0.0.0.0:10104->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33898 process=331/authd The ports (10100, 10101, 10102, 10103, 10104) are internal to FortiOS for redirecting captive portal authentication requests of HTTPS connections to authd daemon and FortiGate does not respond to traffic directed to these internal ports of authd daemon although the output shows the socket is listening. 0.0.0.0:10300->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33892 process=206/authd 0.0.0.0:10301->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33799 process=328/authd 0.0.0.0:10302->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33890 process=329/authd 0.0.0.0:10303->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33898 process=330/authd 0.0.0.0:10304->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33895 process=331/authd The ports (10300, 10301, 10302, 10303,10304) are internal to FortiOS for redirecting captive portal authentication requests of FTP connections to authd daemon and FortiGate does not respond to traffic directed to these internal ports of authd daemon although the output shows the socket is listening. 0.0.0.0:1011->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35065 process=206/authd 0.0.0.0:1012->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35067 process=206/authd 0.0.0.0:1013->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35066 process=206/authd 0.0.0.0:1014->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35068 process=206/authd 0.0.0.0:1015->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35069 process=206/authd 0.0.0.0:1016->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35071 process=206/authd The ports (1011, 1012, 1013, 1014, 1015, 1016) are internal to FortiOS for redirecting http(port 80) traffic from the quarantined list of users to authd daemon and FortiGate does not respond to traffic directed to these internal ports of authd daemon although the output shows the socket is listening (diagnose user quarantine list). 0.0.0.0:10200->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35123 process=206/authd 0.0.0.0:10201->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35124 process=328/authd 0.0.0.0:10202->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35125 process=329/authd 0.0.0.0:10203->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=35961 process=330/authd 0.0.0.0:10204->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33893 process=331/authd The ports (10200, 10201, 10202, 10203, 10204) are internal to FortiOS for redirecting HTTP (port 80) traffic internally to authd daemon and FortiGate does not respond to traffic directed to these internal ports of authd daemon although the output shows the socket is listening. FortiGate does not respond to traffic directed to the above listed internal ports of authd daemon although the output shows the socket is listening. 0.0.0.0:1004->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=33566 process=207/foauthd 0.0.0.0:1005->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37092 process=361/wad The ports 1004 and 1005 are internal to FortiOS for redirecting the HTTP/HTTPS port 8008/8010 connections to foauthd/wad daemon respectively to present UTM block/authentication pages. FortiGate does not respond to traffic directed to these internal ports of foauthd/wad daemon although the output shows the socket is listening. config webfilter fortiguard     set cache-mode ttl     set cache-prefix-match enable     set cache-mem-permille 1     set ovrd-auth-port-http 8008 <- Port to use for FortiGuard Web Filter HTTP override     authentication.     set ovrd-auth-port-https 8010 <- Port to use for FortiGuard Web Filter HTTPS override authentication in proxy mode.     set ovrd-auth-port-https-flow 8015     set ovrd-auth-port-warning 8020     set ovrd-auth-https enable     set warn-auth-https enable     set close-ports disable     set request-packet-size-limit 0     set embed-image disable end 0.0.0.0:5060->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=24370 process=218/voipd 0.0.0.0:5061->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=24371 process=218/voipd The ports 5060, 5061 are used by VOIP daemon/SIP proxy to monitor SIP traffic. These ports may be exposed externally by the following configuration. A local-in policy can be applied to allow or deny traffic to these ports on the FortiGate. config system settings     set sip-tcp-port 5060     set sip-ssl-port 5061 end 0.0.0.0:10600->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37027 process=361/wad 0.0.0.0:10601->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37031 process=361/wad 0.0.0.0:10602->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37035 process=361/wad 0.0.0.0:10603->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37039 process=361/wad 0.0.0.0:10604->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37043 process=361/wad 0.0.0.0:10605->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37047 process=361/wad 0.0.0.0:10606->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37051 process=361/wad 0.0.0.0:10607->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37055 process=361/wad 0.0.0.0:10608->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37059 process=361/wad 0.0.0.0:10700->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37028 process=361/wad 0.0.0.0:10701->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37032 process=361/wad 0.0.0.0:10702->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37036 process=361/wad 0.0.0.0:10703->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37040 process=361/wad 0.0.0.0:10704->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37044 process=361/wad 0.0.0.0:10705->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37048 process=361/wad 0.0.0.0:10706->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37052 process=361/wad 0.0.0.0:10707->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37056 process=361/wad 0.0.0.0:10708->0.0.0.0:0->state=listen err=0 socktype=4 rma=0 wma=0 fma=0 tma=0 inode=37060 process=361/wad 0.0.0.0:7810->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=37095 process=361/wad 0.0.0.0:135->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37089 process=361/wad 0.0.0.0:7800->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37008 process=361/wad 0.0.0.0:7801->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37009 process=361/wad 0.0.0.0:7822->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=37023 process=361/wad 0.0.0.0:7823->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=37010 process=361/wad The TCP ports are internal sockports to FortiOS and used by wad daemon for various traffic inspection purposes. FortiGate does not respond to traffic destined to these internal ports of wad daemon although the socket state indicates listening. 0.0.0.0:7824->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=37012 process=361/wad 0.0.0.0:853->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37014 process=361/wad TCP Port 7824, 853 are internal sockports for DNSoverTLS traffic destined to FortiGate. FortiGate may reply to TCP port 853 traffic only when there is an entry configured under #config system dns-server for DoH/DoT traffic. 0.0.0.0:22->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37090 process=361/wad 0.0.0.0:22->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=33637 process=239/sshd FortiGate may respond to External traffic destined to SSH TCP Standard Port 22 only when SSH or SSH proxy inspection is enabled on WAN facing circuits/policies. 0.0.0.0:53->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=6713 process=244/dnsproxy FortiGate responds to traffic destined to port53 when DNS service is enabled on the interface under #config system dns-server 0.0.0.0:4500->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=6620 process=223/iked FortiGate responds to external traffic destined for TCP port 4500 when IPSec VPN is configured on WAN facing interfaces. config system settings     set ike-tcp-port 4500 end 0.0.0.0:910->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=24363 process=218/voipd The TCP port 910 is internal to FortiOS and used during VOIP Inspection by voipd daemon when SIP ALG/VOIP profile is enabled in firewall policies. FortiGate does not respond to traffic destined to these internal ports of voipd daemon although the socket state indicates listening. 0.0.0.0:2000->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=24365 process=218/voipd FortiGate external-facing interfaces may respond to traffic destined for port 2000 when a firewall policy allows this traffic, and SCCP/VOIP inspection is enabled in the VOIP profile. config voip profile     edit default         config sccp             set status enable         end     next end 0.0.0.0:1007->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=2841 process=371/ipsengine The port 1007 is internal to FortiOS for redirecting the HTTP/HTTPS port 8015 connections to ipsmonitor/ipsengine for presenting UTM block/Authentication pages. FortiGate does not respond to traffic destined to this internal port of ipsengine although the socket state indicates listening. config webfilter fortiguard     set cache-mode ttl     set cache-prefix-match enable     set cache-mem-permille 1     set ovrd-auth-port-http 8008     set ovrd-auth-port-https 8010     set ovrd-auth-port-https-flow 8015     set ovrd-auth-port-warning 8020     set ovrd-auth-https enable     set warn-auth-https enable     set close-ports disable     set request-packet-size-limit 0     set embed-image enable end 0.0.0.0:8013->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=21248 process=240/fsvrd The port 8013 is used by Compliance and Security Fabric/FortiClient Telemetry. FortiGate responds to traffic destined to this port only when this feature is turned on. 0.0.0.0:21->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37085 process=361/wad 0.0.0.0:80->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37063 process=361/wad FortiGate does not respond to traffic destined to these internal ports of wad daemon although the socket state indicates listening- unless these ports are configured or enabled for other purposes, such as FortiGate GUI administration or FTP Virtual IP configuration. 0.0.0.0:1010->0.0.0.0:0->state=listen err=0 socktype=2 rma=0 wma=0 fma=0 tma=0 inode=37081 process=361/wad In the context of diagnose sys tcpsock output, the TCP port 1010 is an internal socket port used during proxy based inspection FortiGate does not respond to traffic destined to these internal ports of wad daemon although the socket state indicates listening. 0.0.0.0:179->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=6938 process=176/bgpd When BGP is configured/enabled, FortiGate will have an implict local in policy and an open socket listening on standard TCP port 179. FortiGate may respond to external traffic on port 179, and a local-in policy must be configured to prevent the device from accepting traffic on external-facing interfaces, unless explicitly intended. 127.0.0.1:54100->0.0.0.0:0->state=listen err=0 socktype=1 rma=0 wma=0 fma=0 tma=0 inode=2220 process=247/fgfmd By default, access to ZebOS shell through Telnet/SSH connections to 127.0.0.1 is blocked by FortiOS. The TCP port 54100 is an internal socket port used by FGFM daemon responsible for managing FortiGate-FortiManager connection. The fgfm protocol runs over SSL (Secure Sockets Layer) using TCP/541 for IPv4. FortiGate does not respond to traffic destined to this internal port (54100) of the fgfmd daemon even though the socket state indicates listening.