NetBios port is open

[AndyNguyen]

Hi, Could someone help me. I created a firewall custom service as follow: Name: MyService Protocol Type: TCP/UDP/SCTP Protocol Source Port Destination Port Low High Low High TCP 1 65535 20 21 TCP 1 65535 80 80 TCP 1 65535 443 443 TCP 1 65535 873 873 UCP 1 65535 873 873 and I created a policy based on this service. But when I applied the policy to my server, I don' t know why the UDP port 137 is still open. Could someone tell me how to fix it? Thank you.

[Warren_Olson_FTNT]

Andy, We may need some additional information to assist you. Is that the only policy you have, ie are there any other policies above/below this one? You are stating that port 137 is open through the FortiGate inspection yes?

[AndyNguyen]

Hi Warren, Thank you for your reply. This is the general look at the policy:

[Warren_Olson_FTNT]

Your top policy is allowing any service, albeit this may not be the direction you' re referring to. Do the following to diagnose: diag debug flow filter dport 137 diag debug flow show console enable diag debug flow show function-name enable diag debug flow trace start 999 diag debug en Just copy/paste the above into an SSH session and then recreate the issue, you should see which policy the traffic is being allowed through " allowed by policyID:1" something along those lines... If you have traffic logging enabled on the policy you can also check out traffic logs and filter by port 137, it will have details on which policy allowed the traffic.

[AndyNguyen]

I got it.. I fixed the problem. Thank you for your help.