Hello,
I have a policy that allows trafic to microsoft related ports (attached image of the policy configured).
On the FortiAnalyzer, the logs show that this policy matches with an accept action for ports TCP 49152-65535 that are not allowed on the said policy (attached image of the log on FortiAnalyzer and the Policy Lookup done to verify that the ports are not allowed).
Is this a bug on the FortiGate or is this an intended behaviour from the FortiGate?
Thanks,
Solved! Go to Solution.
Hello,
Traffic can be allowed by expected sessions (i.e. DCE-RPC port 135).
https://community.fortinet.com/t5/FortiGate/Technical-Tip-DCE-RPC-session-helper/ta-p/198374 (DCE-RPC session helper)
Hello,
Traffic can be allowed by expected sessions (i.e. DCE-RPC port 135).
https://community.fortinet.com/t5/FortiGate/Technical-Tip-DCE-RPC-session-helper/ta-p/198374 (DCE-RPC session helper)
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.