Is It Possible to Implement Port Knocking on FortiGate Firewall?

[nonpe]

Hello,

In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:
FortiGate-120G Hardware
I am looking for advice and community experience regarding the possibility of implementing a port knocking mechanism on a FortiGate firewall.
My goal is to restrict access to specific services and dynamically allow connections only after a predefined sequence of connection attempts (port knocking).
I have reviewed the official documentation and forum discussions, but I would appreciate clarification from those with hands-on experience:
1. Is native port knocking supported on FortiGate?

Scenario:
• 4 ports in a specific sequence
• 2–3 seconds timeout between each attempt
• Final goal: open a real port (e.g. SSH, RDP, Web) only for that IP

Step-by-step process

1️. Initial state
• The firewall completely blocks the real port (e.g. SSH 22).
• It only listens for connection attempts on the knocking ports.

Example ports:
• Port 1 → 4000
• Port 2 → 5000
• Port 3 → 6000
• Port 4 → 7000

2️. First knock
• The client attempts to connect to port 4000.
• The firewall does not respond, but records the IP.
• A 2–3 second timer is started.

The IP moves to state: stage1

3️. Second knock (within 2–3 s)
• The same IP attempts to connect to port 5000.
• If it occurs within the allowed time, the firewall accepts the step.
• The timer is restarted.

The IP moves to stage2

If it takes longer than 3 seconds → the sequence is reset

4️. Third knock (2–3 s)
• Connection to port 6000.
• Same timing control.

The IP moves to stage3

5️. Fourth knock (2–3 s)
• Connection to port 7000.
• If the order and timing are correct:

The IP is authorized
The IP is added to a list such as:
• allowed_clients (with a limited time)

6️. Opening the real port
• The firewall opens the real port (for example SSH 22)
• Only for that IP
• For a limited time (e.g. 30–60 seconds or more)

After that time:
• The port is closed again
• Port knocking must be repeated

2. If not, are there recommended workarounds (e.g. automation, scripts, external systems, or security policies)?
3. Are there FortiGate-native alternatives that achieve a similar security outcome?
Any insights, best practices, or real-world examples would be greatly appreciated.

Thank you in advance for your time and support.