Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
iamus
New Contributor

how to disable port 8009 on fortigate?

I was conducting a scan and I noticed that port 8009 is open. Fingerprinting shows the message " FortiGate Endpoint Control httpd" . Checking the kb, this is a service for downloading software for FortiClient. I do not need this port to be open, especially externally. Is there a way I can disable this port?
7 REPLIES 7
Carl_Wallmark
Valued Contributor

Hi, Uncheck the " FCT-Access" box on the interface facing the Internet.

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
iamus
New Contributor

I don' t see any option for ' FCT-Access' on the port facing the Internet. I got FortiGate 200B
emnoc
Esteemed Contributor III

Close but the port is use for end-point access you can disable it by; config sys global set endpoint-control-fds-access disable end And check by curl or pointing a browser at the port. You should not get this page

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
netzfritze

Hey emnoc, thanks for your posting. I configured:
config sys global 
 set endpoint-control-fds-access disable
 end 
But the page is still reachable. Did you have another idea to the local-in-policy? I can not find in the GUI the policy under Policy/Local-In. Only the default values/policies are visible.
emnoc
Esteemed Contributor III

Another means for disable of this is with a local policy; e.g config firewall service custom edit " stop" set tcp-portrange 8009-8010 next end config firewall local-in-policy edit 1 set intf " wan1" set srcaddr " all" set dstaddr " all" set service " stop" set schedule " always" next end This will let you block it by interface, which will give you better control.

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
SgtMalicious
New Contributor III

Wow, I didn' t realize this was an open port until now! Thanks for the heads up.
emnoc
Esteemed Contributor III

Try the cli firewall rules are similar to the main fwpolicies config firewall local-in-policy edit 1 set intf " any" set srcaddr " all" set dstaddr " all" set service " FDS" set schedule " always" next end FDS is a custom service I built for the ports in questions

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors