Issue with fortigate not allowing me to disable tftp

[jefazo92]

Hi,

In the CLI manual it says very clear that in config system global, tftp can be disabled by running set tftp disable. However, it seems the command is not recognised by Fortigate as whenever I try to run tge disable command, it is not recognised. I have tried show full-config | greo ttftp whithin config system global, and have not obtained any results. Please does anyone know what could bw happening here?

[Ylli_Seitaj]

Hello,

Please provide us the link of CLI manual and also the FortiOS version that is running on your FortiGate.

Best Regards,
Ylli

[SonaMuvv]

Hello,

-I checked this at my end in lab, on versions 7.2.7 and 6.4.15 and there is no option to disable tftp in global settings.

-If you want to disable TFTP, you might want to delete the session helper.

config sys session-helper

sh full

end

-then delete the entry for TFTP.

-https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-and-disable-FortiGate-system-session/ta-p/191762

[Toshi_Esumi]

Not clear what kind of TFTP you want to disable. TFTP server or client or traffic for what? I don't think FGTs are listening to UDP 69 at interfaces (server). If you want to block TFTP traffic through your FGT, you need to block it with policies from an incoming interface to an outgoing interface.

Toshi

[xshkurti]

@jefazo92 
The setting that you are mentioning here to disable tftp on global contest, refers to FortiVoice and not Fortigate.

From GUI it can be done as per this guide:

Disabling recommended features | FortiVoice 7.0.2 | Fortinet Document Library

And it makes sense since tftp is needed for phone provisioning.

From Fortigate there is no tftp setting that can be disabled under system global:
FGT # config system global
FGT (global) # show full | grep tftp
FGT (global) # 

--- empty result on the last line, so no settings to define tftp here

Hope this helps to clarify the manual.