Does deleting an entry in Services disable a service in Fortigate?

[jefazo92]

Hi, 

There are a number of services I would like to disable such as ldap and tftp. I found them listed in Policy & Objects - > Services. If I were to delete the entries there for thses services, would it delete them or would it just delete the entries but keep the services active?

[cravikumar]

If you delete the services, you can't reference it under policy and objects but the services will still be active. Use local-in policy to block services.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-open-ports/ta-p/189671

[jefazo92]

Thank you very much @cravikumar! 

[jefazo92]

Hi @cravikumar, apologies but I should have asked you as well how I may check all the default services, protocols and ports which can be referenced and edited through local-in-policy. I want to block LLDP service and some time ago I found a post some time ago describing the command to find this but I think it might have been removed as I cannot find it any longer.

[SonaMuvv]

Hello,

If you want to know what services can be edited in the local-in-policy, you can run the below command with a question mark and that will show you a list of services that you can use in localin-policy

config firewall local-in-policy

edit x  ---> local-in-policy id

set service ?

Also, I am attaching a documentation to disable LLDP globally and also on interface level.

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/311052/lldp-reception

[sw2090]

in fact those are just objects. Their pure existance does not enable or disable anything. Plus I gues there are factory default objects you probably cannot delete.

Actually Fortigates work the other way round: if you want a service to be enabled you have to create a policy for it (except from interface based ones but these can be enabled/disabed in the interface settings and do not need an object). Anything you did not explicitely enable will always be denied by policy #0 (implicite deny).