Fortigate allows trafic to ports TCP 49152-65535 even though no policy is configured for the ports.

[benslimen]

Hello,

I have a policy that allows trafic to microsoft related ports (attached image of the policy configured).

On the FortiAnalyzer, the logs show that this policy matches with an accept action for ports TCP 49152-65535 that are not allowed on the said policy (attached image of the log on FortiAnalyzer and the Policy Lookup done to verify that the ports are not allowed).

Is this a bug on the FortiGate or is this an intended behaviour from the FortiGate?

Thanks,Policy LookupFAZ LogFirewall Policy

[abarushka · Accepted solution]

Hello,

Traffic can be allowed by expected sessions (i.e. DCE-RPC port 135).

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Session-helpers-and-expectation-sessions/t...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DCE-RPC-session-helper/ta-p/198374 (DCE-RPC session helper)