Unknown open port on WAN interface

[martyyy]

Hi,

Below is the result from a recent nmap scan on all TCP ports.

nmap -p 1-65535 -T4 -A -v x.x.x.x
PORT STATE SERVICE VERSION
113/tcp closed ident
179/tcp open tcpwrapped
443/tcp open ssl/https

50805/tcp open unknown
1 service unrecognized despite returning data.

we use 443 for https, I understand the BGP port tcp179. But I cant find reference of port 50805 anywhere. "diag sys tcpsock " doesnt list 50805, and neither does "Policy & Objects -> Local In" via GUI dashboard.

how can we confirm what is listening on tcp 50805?

Following the article below:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-View-which-ports-are-actively-open-and-in-...

Thank you :) 

[ozkanaltas]

Hello @martyyy ,

When I review the port and protocols document for Fortigate I can't see that port you mentioned. Maybe you have a configuration for that port? Can you check this with this command? 

show full-configuration | grep -f 50805

[AEK]

Hi Marty

As you said it is on WAN port, is your FortiGate behind a modem? If so then you may check if the listening port is on the modem itself.

[dingjerry_FTNT]

Hi @martyyy ,

Do you have any services, i.e. VoIP, passing through FGT?

Another way to check:

1) Scan ports again to see whether you have the same port 50805 still open.  I guess no.

2) Run "diag sys session list" on FGT.

3) Save the outputs with a Text File Editor, like Notepad++.

4) Search for the open port. 

5) Please share the session you found and it's better to share your FGT config.  At least, share the firewall policy for the session you found.