How to open or allow filtered service port such as (Zabbix service TCP port 10050,10051) ?

[aunghtunoo]

Hi all,

I use FortiGate 200D version 5.0 in my network as forefront.

When I scanned by using port scanner(nmap) to all service ports whether open or not on fortigate, as the result show some port are already opened and some port are closed and filtered.

Actually,I want to allow Zabbix service port tcp 10050 and tcp 10051.

Zabbix ports are also show as filtered state on fortigate.

So, how can I allow or open it in fortigate both GUI or CLI?

Pls help me.

Thanks

email: aunghtunoo@reddotnetwork.com

skype: maxdiego2014

[Dave_Hall]

The Fortigate has a set of "open" ports used on it -- if you like to see what those ports are from the GUI, click on the System->config->Features->enable "Local In Policy" then click on "Policy->Local In Policy".  If you want to control/block certain ports directed at the Fortigate, you need to use local-in-polices.  See also Open Ports Diagrams or KB 10773.

Assuming you have a "zabbix" server behind the Fortigate, you can create a VIP to it (on port 10050-10051) from outside going in.  (I am assuming this is what you want.)

1. Create a custom service for ports 10050-10051.

2. Create a VIP to internal IP address of server.

3. Create a Firewall Policy using the above.

[aunghtunoo]

Hi

This morning, I tested your instruction but it is still not okay.

So, pls see my setting in fortigate in attach file.

Pls help me how to solve it.

I very appreciate your help.

Thanks so much again.

[rwpatterson]

In your custom service, try changing the source port range to 1-65535. (as Dave has shown)

[Dave_Hall]

If both subnets are internal/trusted, you may want to forgo the VIP altogether and just set the dest. address (on the firewall policy) to the zabbix server (192.168.13.20). NAT should be disabled on the fw policy unless you want the Zabbix server to see the traffic coming from the [strike]Vlan12_lan's[/strike] vlan13_Mgmt interface.

Custom services are usually dest port orientated, so (as Bob indicated) set  the source port range to 1-65535.

If you are still having trouble, you may try sniffing the traffic, something along these lines:

diag debug reset diag debug flow filter addr <IP Address> diag debug flow filter proto 6 diag debug flow filter port <port number> diag debug flow show console enable diag debug flow trace start 1000 diag debug en