Block port 22 SSH

[ncfom]

Hy Everbody !

I want to disable in my fortigate 90 the SSH port 22.

It is necessary to create a policy or I need to disable an option ?

Thank you !

[Nishad · Accepted solution]

Do you enable ssh to form a WAN interface? if possible please share the screenshot.

[Nishad]

You just need to untick the ssh from the interface. Or else from system setting, you can change the ssh port from 22 to custom port.

[ncfom]

Thank you for you answer.

I untick the ssh from the interface (network - interface) and I modify the ssh port (system-settings) from 22 to a custom port but is still open when I check on the internet

Other sugestions ?

[Nishad · Accepted solution]

Do you enable ssh to form a WAN interface? if possible please share the screenshot.

[Dave_Hall · Accepted solution]

Hi Cosmin.

What exactly are you trying to do?  The info provided by Nishad is for blocking port 22 access to the fgt from the interface (usually a WAN port).  If you are trying to block people (devices) from accessing port 22 at any addresses on the Internet (e.g. outside your fgt) you need to craft a firewall policy that blocks that port from Internal->WAN1 (e.g. connections going out the WAN port).

BTW I suggest leaving the ssh port value setting at 22 but uncheck SSH on the interface (e.g. WAN1) if you do not want people/devices attempting to access your fgt from outside. 

Haven't tested this myself, but I assume the fgt will assume the default value for the SSH port will always be what is defined under system global.

system global set admin-ssh-port <value> end

(edited)

[ncfom]

Thank you for your answers.

I want to block SSH port 22 from the internet to my Fortigate

Bellow I have made some printscreens from my device with some settings that I have made regarding this port 22

As you all see I changed the port from 22 to 2222, I uncheck the box SSH

[ncfom]

And the other printscreen

[ede_pfau]

You've allowed access from FortiCloud - this might well use port 22. Check with FTNT docs and the KB.

[rwpatterson]

ncfom wrote:

Thank you for you answer.

I untick the ssh from the interface (network - interface) and I modify the ssh port (system-settings) from 22 to a custom port but is still open when I check on the internet

Other sugestions ?

What are you checking, port 22 or your custom port? Also what are you trying to block access to? The Fortigate or a device behind it?