PORTS

[FortiSpain]

Good morning,

We have a FortiGate 50G installed at home. The device has been set by the company who sold it to us. The FortiGate is used over 2 routers from 2 different providers. We have asked the company to close all the ports as the use of internet here is domestic. When using nmap in order to check possible open ports, the results are:

113/tcp  closed ident

2000/tcp open   cisco-sccp

5060/tcp open   sip

I have used the WAN IP of the Forti as target. Maybe I am doing it wrongly... Here there is the Firewall Policy:

The company told us that the ports are closed but here at home we are a little bit worried. Please, could you confirm that the policies are correct in order to close all the ports? If positive, how is it possible that nmap shows open ports (I have done the process 4 or 5 times)? 

We are not professional here and our goal is to be completely protected only.

Thank you very much.

[AEK]

Hi FortiSpain

Here I see you don't have any policy allowing anything from WAN to LAN. There is only from LAN to LAN, and from VPN tunnel to LAN and WAN.

You can check if those open ports are actually for local-in traffic, I mean to address the firewall itself.

You can check it as follows:

• Check if the WAN interfaces have any published service (HTTPS, SSH, ... etc)
• Check the ports used for SSL VPN and/or IPsec VPN if they match the ports found by nmap

If nothing found, then probably the front-end routers are the main suspects.