Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Fuss93
New Contributor

PORT 7450 and 20080 is closed

Good morning all,

I'm having trouble opening port 7450 and another port,

There are some that open that work fine but for ports 7450 and 20080 it refuses to open them even though I did the same for the ports that are open. I don't understand why it doesn't work.

What I did was a virtual IP address with my public IP address on my targeted local IP address and opened port 7450 and created a rule for that as well.

But when I go on tools to check port 7450 it is close

Thank you for your answers.

11 REPLIES 11
Toshi_Esumi
SuperUser
SuperUser

Does the destination IP live on the FGT? If not, it might be closed on the server/destination side.

Fuss93

Hi, I'm sorry but what is FGT because the acronym in English is hard because I'm French I'm sorryv

Toshi_Esumi

I meant FortiGate. Some just use FG.

Fuss93

Yes I use FG but 7450 and 20080 are not open

Toshi_Esumi

Then again, is it out-to-in or in-to-out? And the destination IP is outside of the FGT?

Fuss93

it is incoming and outgoing call and the outgoing call points to an IP address outside the FTG

Toshi_Esumi

So this is for your phone system connected to a service provider on the Internet.

Did you configured a VIP for out-to-in traffic so the provider reaches the outside/public IP at the FGT then mapped to the server's local/private IP? I'm assuming you scanned the public IP from the Internet and found those ports closed, right? Then please share the vip config via CLI after masking public IP(s).

Fuss93
New Contributor

Hello,

Thanks for your reply and here is the screenshot and yes I have used the online tools which help me see if my port is closed :)

Toshi_Esumi

Then, as long as the policy that has this vip applied is allowing TCP 7450 and 20080 toward the interface the phone system is connected, and as long as the system is listening to the ports, those ports should show up as open when you scan the wan2's IP.

I would look at the phone system side. But to prove the FGT is passing the scan packets for those ports, you can sniff the inside port with 'host 192.168.0.178' while scan is happening. You should see them passing through.

If you can't see them, now you have to run "flow debug" to see why the FGT is dropping. You can find "how to" by simply putting "fortigate flow debug" in an internet search. You need to set filter with those ports.

If you're not comfortable doing it or don't have time, just open a ticket and get help from TAC.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors