Firewalls ports for FortiManager connection

[EvanRaci]

Hi all,

I would like to configure  ACL for FortiGate and FortiManager connection. The devices are deployed in a closed network and FortiManager is acting as Local FDS FortiGuard server.

For licensing update , FortiGate will get update from FortiManager. As per the document , we need to allow TCP/443 and TCP/8890 for FortiGuard override service.

I'm confused what incoming and outing ports means by the document 

FortiGate to FortiManager ( Is it incoming port?)

FortiManager to FortiGate ( Is it Outgoing port?)

https://docs.fortinet.com/document/fortimanager/7.2.0/fortimanager-ports/465971/incoming-ports

As per the document , TCP 8890 need to allow for incoming ports . Does that means  from FortiGate to FortiManager IP?

Or is it 443 and 8890 need to allow for both direction  : FG > FMG and FMG > FG ?

Please help me, thank you

[jasonhong · Accepted solution]

Hi,

In the context of incoming/outgoing between FGT and FMG,

Incoming: Configuring your ACL to allow incoming traffic (port/protocol X) from FGT to FMG

Outgoing: Configuring your ACL to allow outgoing traffic (port/protocol X) from FMG to FGT

[vraev]

Hi @EvanRaci ,

The INcoming (open) ports are the ones related to the FMG itself.

Like TCP/541 which is the  FGFM port. All the connections from the FGT to FMGwill be made to the through this TCP port.
And OUTgoing  are like the tcp 443 that is used to contact the FortiGuard servers.