how to disable port 8009 on fortigate?

[iamus]

I was conducting a scan and I noticed that port 8009 is open. Fingerprinting shows the message " FortiGate Endpoint Control httpd" . Checking the kb, this is a service for downloading software for FortiClient. I do not need this port to be open, especially externally. Is there a way I can disable this port?

[Carl_Wallmark]

Hi, Uncheck the " FCT-Access" box on the interface facing the Internet.

[iamus]

I don' t see any option for ' FCT-Access' on the port facing the Internet. I got FortiGate 200B

[emnoc]

Close but the port is use for end-point access you can disable it by; config sys global set endpoint-control-fds-access disable end And check by curl or pointing a browser at the port. You should not get this page

[netzfritze]

Hey emnoc, thanks for your posting. I configured:

config sys global 
 set endpoint-control-fds-access disable
 end 

But the page is still reachable. Did you have another idea to the local-in-policy? I can not find in the GUI the policy under Policy/Local-In. Only the default values/policies are visible.

[emnoc]

Another means for disable of this is with a local policy; e.g config firewall service custom edit " stop" set tcp-portrange 8009-8010 next end config firewall local-in-policy edit 1 set intf " wan1" set srcaddr " all" set dstaddr " all" set service " stop" set schedule " always" next end This will let you block it by interface, which will give you better control.

[SgtMalicious]

Wow, I didn' t realize this was an open port until now! Thanks for the heads up.

[emnoc]

Try the cli firewall rules are similar to the main fwpolicies config firewall local-in-policy edit 1 set intf " any" set srcaddr " all" set dstaddr " all" set service " FDS" set schedule " always" next end FDS is a custom service I built for the ports in questions