PORTS

[FortiSpain]

Good morning,

We have a FortiGate 50G installed at home. The device has been set by the company who sold it to us. The FortiGate is used over 2 routers from 2 different providers. We have asked the company to close all the ports as the use of internet here is domestic. When using nmap in order to check possible open ports, the results are:

113/tcp  closed ident

2000/tcp open   cisco-sccp

5060/tcp open   sip

I have used the WAN IP of the Forti as target. Maybe I am doing it wrongly... Here there is the Firewall Policy:

The company told us that the ports are closed but here at home we are a little bit worried. Please, could you confirm that the policies are correct in order to close all the ports? If positive, how is it possible that nmap shows open ports (I have done the process 4 or 5 times)? 

We are not professional here and our goal is to be completely protected only.

Thank you very much.

[AEK]

Hi FortiSpain

Here I see you don't have any policy allowing anything from WAN to LAN. There is only from LAN to LAN, and from VPN tunnel to LAN and WAN.

You can check if those open ports are actually for local-in traffic, I mean to address the firewall itself.

You can check it as follows:

• Check if the WAN interfaces have any published service (HTTPS, SSH, ... etc)
• Check the ports used for SSL VPN and/or IPsec VPN if they match the ports found by nmap

If nothing found, then probably the front-end routers are the main suspects.

[FortiSpain]

Hi AEK,

Thank you very much for your answer.

Regarding the Wan interfaces:

In local in Policy, you can see this:

The last nmap scan (first 10000 ports) shows this: allthe ports (TCP) are open. We are worried...

Thanks for your help.

[AEK]

I don't see any port similar to the 3 mentioned in your first post.

Then it is probably from the ISP router.

[FortiSpain]

Thank you very much for your help. How can I close almost all the ports on the routers? Because I know I have never open any port as the function options are quite limited when editing the router. Do you think that having open ports means a risk when our domestic net is only connected by ethernet (No wifi)?

Thanks again.

[AEK]

How to close ports depends on the brand and model of the router.

An open port (listening service) is an additional risk. One of main security rules is to close all ports that are not required. The same applies to Ethernet and WiFi.

[FortiSpain]

Thanks again for your time.

Using nmap -sV -sC --top-ports 1000 -T5 --min-rate 1000 -Pn -n, the results are:

PORT     STATE  SERVICE     VERSION

113/tcp  closed ident

2000/tcp open   cisco-sccp?

5060/tcp open   sip?

... Like my first post.

I am a little bit confused. According to chatGPT (yes: I am using it...), everything is normal and secure.

I use occasionally a phone plugged to the router.

What is your opinion?

Thank you

[mpapisetty]

Hi @FortiSpain ,

You could use the steps outlined in these two articles to close the ports -

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Closing-TCP-port-113/ta-p/195373

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-close-port-TCP-UDP-5060-and-TCP-200...

[FortiSpain]

Thanks again Manoj,

In the second article, when I go to System >> Settings and then click on "Edit on CLI", "config system settings" does not appear. Instead, this is what I see:

So the commands do not work...

In the first article, I have to go to "Config System Interface". I have found it on Network >> Interfaces... This is what appears:

And I do not know which "Interface name" I have to use. If you could let me know exactly what I have to write so I can use copy/paste, this would be great. I am not looking to be a cybersecurity expert... Just to set the Fortigate secure and forget it as soon as possible.

Thank you

[mpapisetty]

Hi @FortiSpain ,

The first article clearly states the exact CLI you need to enter - 

config system settings
    set default-voip-alg-mode kernel-helper-based 
end

I am not sure why would go to system settings and then click on CLI from there. Just access the CLI console from the top right of the screen and put in the commands. Let me know if it doesn't work. 

For the second one, you need to disable on the port facing the internet if that was the original concern. Essentially, disable on ports that you think should stay secure.