summary of ports that are open by default

[Ralph1973]

Hello all,

One of our customers did have a security audit and noticed that there are ports opened on the firewall which are not configured via a firewall policy. They want all ports that are not needed will be set to close.

I know the Fortigate Open Ports Diagram, but this doesn't cover all ports that are opened by default.

When you deploy a Fortigate vm (5.2.6) and only enable the webgui/ssh access and then execute the command 'diag sys tcpsock' you will notice ports that are not listed in the diagram:

0.0.0.0:[style="background-color: #ff0000;"]709[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:1000->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1001[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1002[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:1003->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1004[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1005[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1006[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:80->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1011[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1012[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:53->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:1013->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:22->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1014[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:23->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1015[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1016[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1017[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1018[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]2650[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:443->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1019[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]7900[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x2 rma=0 wma=0 fma=0 tma=00.0.0.0:[style="background-color: #ff0000;"]1020[/style]->0.0.0.0:0->state=listen err=0 sockflag=0x8 rma=0 wma=0 fma=0 tma=00.0.0.0:541->0.0.0.0:0->state=listen err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=0192.168.247.132:22->192.168.247.1:62950->state=estabilshed err=0 sockflag=0x1 rma=0 wma=2296 fma=5896 tma=0192.168.247.132:80->192.168.247.1:62936->state=time_wait err=0 sockflag=0x0192.168.247.132:80->192.168.247.1:62930->state=time_wait err=0 sockflag=0x0192.168.247.132:80->192.168.247.1:62931->state=time_wait err=0 sockflag=0x0192.168.247.132:80->192.168.247.1:62934->state=time_wait err=0 sockflag=0x0192.168.247.132:80->192.168.247.1:62935->state=estabilshed err=0 sockflag=0x1 rma=0 wma=0 fma=0 tma=0192.168.247.132:80->192.168.247.1:62927->state=time_wait err=0 sockflag=0x100

Does anyone has an overview that includes all ports?

Thanks and regards,

Ralph Willemsen

Arnhem, Netherlands

[emnoc]

Before you do that get the  fortinet what ports are used diagram. Diag sys tcpsock is not 100% accurate for determining the  listener state, but each port that's actually open can be backtrack the FTNT  document and purpose " what ports fortigte open".

reference

http://docs.fortinet.com/uploaded/files/1880/FortinetOpenPorts.pdf

You can explain  the above to  the auditor and if they are good will understand. The ports that are truly open can be closed down if required via local-in  but the numbers should be small if any

[Ralph1973]

Hello Emnoc, thanks for your advice, I appreciated this.

Indeed it looks like 'diag sys tcpsock' is not accurate, e.g. a portscan won't reveal all 'open' ports.

Kind regards,

Ralph