Hello,
I'm failing a PCI Compliance scan due to port 8010. In my research I found that this port is used for Web Override.
60D Firmware 5.0.11
I've entered the command:
config webfilter fortiguard
set close-port enable
According to an article I found here: http://kb.fortinet.com/kb/documentLink.do?externalID=FD33190
this should stop the Fortigate from listening on both of those ports. My device actually isn't listening on port 8008 no matter what I change that setting to but it also doesn't stop it from listening on port 8010. Any ideas?
I'm on with support right now and I'll post the answer once I'm done.
Christian Paesano | chrispaesano@gmail.com | NSE4-2015-25749
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
So far I've learned that the FortiClient EndPoint Registration is listening on port 8010. I'm still trying to figure out how to disable it. Hopefully Support will get it before I do. :)
Christian Paesano | chrispaesano@gmail.com | NSE4-2015-25749
The fix was to create a local-in-policy to block the port. It didn't make sense to reconfigure the port for forticlient-reg-port because it would have caused us to have to change xml files for the forticlients.
Christian Paesano | chrispaesano@gmail.com | NSE4-2015-25749
Hi Christian, TCP ports 8008 and 8010 are used for the FortiGuard block pages as well as the FortiGuard override pages. So if you use this ports, you may encounter this type if issue which is expected. So the solution is to change the override ports; You can view the current settings using the below commands #show full webfilter fortiguard config webfilter fortiguard set ovrd-auth-port-http 8008 <<<< set ovrd-auth-port-https 8010 <<< To change the port number, you can use this commands; config webfilter fortiguard set ovrd-auth-port-http xxxx //change to different unused port for ex 58000. set ovrd-auth-port-https yyyy // change to different unused port for ex 58001. end
Is there a way to close those ports but still have the Replacement messages showing correctly?
We don't use the overide option so I tried to change the ports to 443 (that port has to be open anyway) but I can't in 5.4.4.
I just want to close ports 8008 8010 and 8020 but still have the replacement messages for blocked pages or apps.
Fortigate : 80E, 80F, 100E, 200F, 300E : 6.4.6
FortiAnalyzer, ForticlientEMS
Hi
These ports (8010 and 8020) are used by the Web Filter profile. If you have an equipment added to a policy and that policy have a Web Filter profile added, these ports will appear on the port scans.
What can you do?
NOTE: MAKE A FULL BACKUP BEFORE!!!!
[ul]You can also look on the knowledge base of how to enable strong encryption, but this option will make your equipment CPU stress.
Following configuration worked perfectly for me. 100D: Firmware Version v5.4.6,build1165 (GA)
FG100D # config webfilter fortiguard
FG100D (fortiguard) # get cache-mode : ttl cache-prefix-match : disable cache-mem-percent : 2 ovrd-auth-port-http : 8008 ovrd-auth-port-https: 8010 ovrd-auth-port-warning: 8020 ovrd-auth-https : disable warn-auth-https : disable close-ports : enable request-packet-size-limit: 0
FG100D (fortiguard) # FG100D (fortiguard) #
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1641 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.