fortigate policies

[unknown1020]

Friends, how are you?
A question:
Why is it not recommended to put all the ports "ALL" in the policies?

[vsahu]

Hello unknown1020,

It is always best to provide the least access to the end users, or required access only, so you can stop malicious activities as much as possible. It is similar to the principle of least privilege (POLP), Users should only be granted permission to read, write or execute only the files or resources necessary to do their jobs.

Also configuring only required ports in the policy will help with configuring the granular security Profile.

[Christian_89]

Hello! I'm doing well, thank you. I hope you are too.

To answer your question, specifying "ALL" for the ports in firewall policies is generally not recommended for a couple of reasons related to security and control:

1. **Principle of Least Privilege**: This is a security concept where a user or a process should only be able to access the resources (such as ports) that are necessary for its legitimate purpose. If you open all ports, it means that you are not following this principle, and you might be providing more access than necessary.

2. **Potential Security Risk**: If all ports are open, it could potentially expose your network to various types of attacks. An attacker who gains access to your network could have free reign to attempt to exploit any open ports to gain further access or disrupt services.

3. **Traffic Control and Management**: If you have specific policies for specific ports, it's easier to manage and control the network traffic. You can create different rules for different types of traffic, which can help in troubleshooting and in maintaining the performance of the network.

4. **Regulatory and Compliance Reasons**: Depending on the nature of the system or data being protected, there may be specific regulatory or compliance requirements that mandate certain ports to be closed or restricted.

Remember, the more open your network is, the more opportunity there is for something to go wrong. It's generally a good idea to only open the ports that you know you need.