We have a student who i think is using a VPN which uses TCP/UDP 28298 because that's all I see in her Forward traffic reports. Also on O365 it shows me she's a risky user logging in from various different countries!
We have a FortiGate 300E running 6.2.2 Firmware.
Thanks,
Jenny
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
hi, am not an expert but here what i suggest 1)you can create at service name custom_block_port in objects & security tab then in that service mention the port range for both TCP 28298-28298 & UDP 28298-28298, 2)create new deny policy mention & mention the particular service only in service that that we just created and move this policy at top. 3)Now every traffic goes to those ports will be denied as per policy.(i had tried to block UDP port 80 & 443 for google chrome it worked for me)
[size="1"] FGT100E,FGT100D,FGT300C,FGT300E[/size] FortiOS 5.2, 5.4, 5.6,6.0,6.0.2 and 6.2
Thanks @Vishalv16 I have created the custom block port and added it to a new deny policy but it's not blocked for the student i was monitoring still as she is an timed policy further down where it is allowed. Not sure how that works, as you can't allow and block in the same policy!
right you can't allow & block in same policy. did you move policy at the top as firewall read policy from top to bottom 1st policy will be taken into consideration & next to that even if its deny it will not block traffic as allow policy is above it in list can you share screenshot of your policy what you created & service as well. Note: if you think its using an VPN you can add application control filter to policy then then block all the VPN application(proxy category) to use inside the network. Regards Vishal
[size="1"] FGT100E,FGT100D,FGT300C,FGT300E[/size] FortiOS 5.2, 5.4, 5.6,6.0,6.0.2 and 6.2
Keep in mind when blocking certain ports you will want the destination ports, which I think the fgt defaults to. Source port(s) should be set as 0-65535. When first applying such a block you will want to disconnect (end) any currently open sessions directed at those ports.
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.