Hide Firewall OS version from scan

[kr151]

Hello, I have a question, is there a way to hide the visibility of OS version and other services on Fortigate. Actually a vulnerability report shows that it is possible through scan to obtain certain specific info, like OS version, Open Ports, etc... on the internet. Does anyone know of a way to actually hide that info. Thanks for your help!!!

[emnoc]

You have a few items to consider if you have anything open facing the untrusted internet, but to be honest I wouldn' t worry about my FortiOS version being detected 1: run WEBgui on a port that' s not-common 2: run ssh on a port that' s not-common 3: disable ident " set ident-accept disable" on each external interface

[TopJimmy]

ORIGINAL: emnoc 3: disable ident " set ident-accept disable" on each external interface

other way around according to the knowledge base: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=11763&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=38514481&stateId=0%200%2038512846 For example, to disable ident responses on a network interface names port1, you would enter the following commands: config system interface edit port1 set ident-accept enable next end TCP 113 is closed.

[ede_pfau]

Better still, don' t use admin access on the WAN port! Instead, create a dial-in IPsec VPN and enable administration from the internal interface. That really doesn' t take longer than 5 minutes, and the IPsec client is for free.

[ddskier]

That seems counter intuitive. Run " set ident-accept enable" to disable it? Is that a type-o in the KB? or is that really the correct setting?

[TopJimmy]

ORIGINAL: ddskier That seems counter intuitive. Run " set ident-accept enable" to disable it? Is that a type in the KB? or is that really the correct setting?

I agree but that' s what it is. All the documentation (fundamentals handbook, admin handbook and CLI reference) say the same thing.