PORTS

[FortiSpain]

Good morning,

We have a FortiGate 50G installed at home. The device has been set by the company who sold it to us. The FortiGate is used over 2 routers from 2 different providers. We have asked the company to close all the ports as the use of internet here is domestic. When using nmap in order to check possible open ports, the results are:

113/tcp  closed ident

2000/tcp open   cisco-sccp

5060/tcp open   sip

I have used the WAN IP of the Forti as target. Maybe I am doing it wrongly... Here there is the Firewall Policy:

The company told us that the ports are closed but here at home we are a little bit worried. Please, could you confirm that the policies are correct in order to close all the ports? If positive, how is it possible that nmap shows open ports (I have done the process 4 or 5 times)? 

We are not professional here and our goal is to be completely protected only.

Thank you very much.

[FortiSpain]

Hi AEK,

Thank you for your advice. I just want to have the firewall ready to start feeling secure. As I said in another reply, I have no interest in being an expert in Cybersecurity at all. Just to leave the firewall ready to protect a home... Not a company.

The firewall was installed by a cybersecurity company who did not update the IPS. So I can not count on them. I have updated the IPS myself with some help, connecting my Mac to the firewall through Terminal and ssh. And it worked. And yes: I will do a lot of mistakes, a lot of stupid questions but I do not care at all. My goals are simple: to close ports, which does not seem to be difficult, and a couple of additional points.

I am a Real Estate Agent and musician. I am taking part of the nights trying to configure a Firewall. My parents, who are more than 80 years old,  have been hacked. And I just want to protect them. I have learn how to set a router, how to use Terminal, nmap, wireshark, VPN... But this is like Mars for me. With your help and with Fortinet, I do not think this will take too much for anybody less than me.

And my user name is FortiSpain, not FortiSpam... I have laughed by the way...

So, can you let me know if you are seeing the ports open on WAN? If yes, could you be so kind as to guide me to close them?

Thank you

[AEK]

Hi FortiSpain

Sorry for the typo error, I also laughed a lot but it was a mistake and without any bad intention.

Regarding WAN interface, you have multiple services enabled on both WAN ports.

You just need to edit each WAN interface and disable all the services (ping, http, https and ssh).

[AEK]

"I use occasionally a phone plugged to the router"

That explains why SIP and SCCP are listening.

If you want to protect them with the FortiGate you will need to change your design to bring your VoIP behind the firewall instead of leaving it at front-end router level.

Meanwhile you should keep everything patched (router, phone, FGT) to avoid known vulnerabilities, and you may also work with a pentester to check if there are some exploitable breaches.

[FortiSpain]

Hi AEK and thank you very much for your time.

If you want to protect them with the FortiGate you will need to change your design to bring your VoIP behind the firewall instead of leaving it at front-end router level.

That sounds very well. I asked the company who installed the firewall to do it but they say that they are not able to make it.

Could you be so kind as to let me know the steps in order to bring my VoIP behind the firewall? It is really important for us.

Thank you.

---

[AEK]

Hello FortiSpain

Unfortunately I don't have enough knowledge in VoIP. Hope another experienced member can help.

[FortiSpain]

Hi AEK,

I appreciate all your help. I will find out how to manage with it. Thank you very much.