PORT 7450 and 20080 is closed

[Fuss93]

Good morning all,

I'm having trouble opening port 7450 and another port,

There are some that open that work fine but for ports 7450 and 20080 it refuses to open them even though I did the same for the ports that are open. I don't understand why it doesn't work.

What I did was a virtual IP address with my public IP address on my targeted local IP address and opened port 7450 and created a rule for that as well.

But when I go on tools to check port 7450 it is close

Thank you for your answers.

[Toshi_Esumi]

Does the destination IP live on the FGT? If not, it might be closed on the server/destination side.

[Fuss93]

Hi, I'm sorry but what is FGT because the acronym in English is hard because I'm French I'm sorryv

[Toshi_Esumi]

I meant FortiGate. Some just use FG.

[Fuss93]

Yes I use FG but 7450 and 20080 are not open

[Toshi_Esumi]

Then again, is it out-to-in or in-to-out? And the destination IP is outside of the FGT?

[Fuss93]

it is incoming and outgoing call and the outgoing call points to an IP address outside the FTG

[Toshi_Esumi]

So this is for your phone system connected to a service provider on the Internet.

Did you configured a VIP for out-to-in traffic so the provider reaches the outside/public IP at the FGT then mapped to the server's local/private IP? I'm assuming you scanned the public IP from the Internet and found those ports closed, right? Then please share the vip config via CLI after masking public IP(s).

[Fuss93]

Hello,

Thanks for your reply and here is the screenshot and yes I have used the online tools which help me see if my port is closed :)

[Toshi_Esumi]

Then, as long as the policy that has this vip applied is allowing TCP 7450 and 20080 toward the interface the phone system is connected, and as long as the system is listening to the ports, those ports should show up as open when you scan the wan2's IP.

I would look at the phone system side. But to prove the FGT is passing the scan packets for those ports, you can sniff the inside port with 'host 192.168.0.178' while scan is happening. You should see them passing through.

If you can't see them, now you have to run "flow debug" to see why the FGT is dropping. You can find "how to" by simply putting "fortigate flow debug" in an internet search. You need to set filter with those ports.

If you're not comfortable doing it or don't have time, just open a ticket and get help from TAC.