Disabling Port 8010

[chrispaesano]

Hello,

I'm failing a PCI Compliance scan due to port 8010. In my research I found that this port is used for Web Override.

60D Firmware 5.0.11

I've entered the command:

config webfilter fortiguard

set close-port enable

According to an article I found here: http://kb.fortinet.com/kb/documentLink.do?externalID=FD33190

this should stop the Fortigate from listening on both of those ports. My device actually isn't listening on port 8008 no matter what I change that setting to but it also doesn't stop it from listening on port 8010. Any ideas?

I'm on with support right now and I'll post the answer once I'm done.

[chrispaesano]

So far I've learned that the FortiClient EndPoint Registration is listening on port 8010. I'm still trying to figure out how to disable it. Hopefully Support will get it before I do. :)

[chrispaesano]

The fix was to create a local-in-policy to block the port. It didn't make sense to reconfigure the port for forticlient-reg-port because it would have caused us to have to change xml files for the forticlients.

[rpmadathil_FTNT]

Hi Christian, TCP ports 8008 and 8010 are used for the FortiGuard block pages as well as the FortiGuard override pages. So if you use this ports, you may encounter this type if issue which is expected. So the solution is to change the override ports; You can view the current settings using the below commands #show full webfilter fortiguard config webfilter fortiguard     set ovrd-auth-port-http 8008 <<<<     set ovrd-auth-port-https 8010 <<<      To change the port number, you can use this commands; config webfilter fortiguard set ovrd-auth-port-http xxxx //change to different unused port for ex 58000. set ovrd-auth-port-https yyyy // change to different unused port for ex 58001. end

[mike_dp]

Is there a way to close those ports but still have the Replacement messages showing correctly?

We don't use the overide option so I tried to change the ports to 443 (that port has to be open anyway) but I can't in 5.4.4.

I just want to close ports 8008 8010 and 8020 but still have the replacement messages for blocked pages or apps.

[Arcruz]

Hi 

These ports (8010 and 8020) are used by the Web Filter profile. If you have an equipment added to a policy and that policy have a Web Filter profile added, these ports will appear on the port scans.

What can you do? 

NOTE: MAKE A FULL BACKUP BEFORE!!!!

[ul]

Create a policy without Web Filter and add the equipments to it.

if you need the web filter, disable port 8010 and 8020 from the command windows on the Fortinet by using these commands:[ul]

config global config webfilter fortiguard set close-ports disable end end[/ul][/ul]

You can also look on the knowledge base of how to enable strong encryption, but this option will make your equipment CPU stress.

[kashifr86]

Following configuration worked perfectly for me. 100D: Firmware Version v5.4.6,build1165 (GA) 

FG100D # config webfilter fortiguard

FG100D (fortiguard) # get cache-mode : ttl cache-prefix-match : disable cache-mem-percent : 2 ovrd-auth-port-http : 8008 ovrd-auth-port-https: 8010 ovrd-auth-port-warning: 8020 ovrd-auth-https : disable warn-auth-https : disable close-ports : enable request-packet-size-limit: 0

FG100D (fortiguard) # FG100D (fortiguard) #