Port knocking

[ben6400]

Is there a way to set up Port Knocking on 7.4.x

[jjdope]

Firstly I have not tested this but I don't see why it should not work.

Scenario -> Allow SSH Access to FortiGate if the same user is knocking at 1001,1002 and 1003 ports.

1. Configure a firewall policy to deny external access to the SSH port by default.

2. Set up FortiGate to log connection attempts whenever someone tries accessing to the closed ports.

3. These logs should be monitored properly on a syslog server (FGT should send these logs live)

4. A python script should be created which always monitors the logs. When it sees that a user has knocked on 1001,1002 and 1003 in that order then the script should send API or SSH commands to the FortiGate which basically modifies or adds a firewall policy (only for that user) to be able to SSH to the machine. If a time limit could be set for the amount of time the port will be open, then even better.