Hot!Disabling Port 8010

Author
chrispaesano
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/05/29 07:33:25
  • Status: offline
2015/06/05 09:42:11 (permalink)
0

Disabling Port 8010

Hello,
 
I'm failing a PCI Compliance scan due to port 8010. In my research I found that this port is used for Web Override.
 
60D Firmware 5.0.11
 
 
I've entered the command:
 
config webfilter fortiguard
set close-port enable
 
According to an article I found here: http://kb.fortinet.com/kb/documentLink.do?externalID=FD33190
 
this should stop the Fortigate from listening on both of those ports. My device actually isn't listening on port 8008 no matter what I change that setting to but it also doesn't stop it from listening on port 8010. Any ideas?
 
I'm on with support right now and I'll post the answer once I'm done.

Christian Paesano | chrispaesano@gmail.com | NSE4-2015-25749
#1

5 Replies Related Threads

    chrispaesano
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2015/05/29 07:33:25
    • Status: offline
    Re: Disabling Port 8010 2015/06/05 09:51:37 (permalink)
    0
    So far I've learned that the FortiClient EndPoint Registration is listening on port 8010. I'm still trying to figure out how to disable it. Hopefully Support will get it before I do. :)
    #2
    chrispaesano
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2015/05/29 07:33:25
    • Status: offline
    Re: Disabling Port 8010 2015/06/05 10:20:28 (permalink)
    0
    The fix was to create a local-in-policy to block the port. It didn't make sense to reconfigure the port for forticlient-reg-port because it would have caused us to have to change xml files for the forticlients.
    #3
    rpmadathil_FTNT
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2015/05/25 03:21:31
    • Status: offline
    Re: Disabling Port 8010 2015/06/11 01:50:56 (permalink)
    0
    Hi Christian,

    TCP ports 8008 and 8010 are used for the FortiGuard block pages as well as the FortiGuard override pages. So if you use this ports, you may encounter this type if issue which is expected. So the solution is to change the override ports;

    You can view the current settings using the below commands

    #show full webfilter fortiguard
    config webfilter fortiguard
        set ovrd-auth-port-http 8008 <<<<
        set ovrd-auth-port-https 8010 <<<

        
    To change the port number, you can use this commands;

    config webfilter fortiguard
    set ovrd-auth-port-http xxxx //change to different unused port for ex 58000.
    set ovrd-auth-port-https yyyy // change to different unused port for ex 58001.
    end



    #4
    mike_dp
    Bronze Member
    • Total Posts : 25
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/02/22 12:26:22
    • Status: offline
    Re: Disabling Port 8010 2017/03/03 08:47:04 (permalink)
    0
    Is there a way to close those ports but still have the Replacement messages showing correctly?
     
    We don't use the overide option so I tried to change the ports to 443 (that port has to be open anyway) but I can't in 5.4.4.
     
    I just want to close ports 8008 8010 and 8020 but still have the replacement messages for blocked pages or apps.
    #5
    Arcruz
    New Member
    • Total Posts : 1
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/18 10:49:14
    • Status: offline
    Re: Disabling Port 8010 2018/08/18 11:13:26 (permalink)
    0
    Hi 
    These ports (8010 and 8020) are used by the Web Filter profile. If you have an equipment added to a policy and that policy have a Web Filter profile added, these ports will appear on the port scans.
     
    What can you do? 
     
    NOTE: MAKE A FULL BACKUP BEFORE!!!!
    • Create a policy without Web Filter and add the equipments to it.
    • if you need the web filter, disable port 8010 and 8020 from the command windows on the Fortinet by using these commands:
      • config global
        config webfilter fortiguard
        set close-ports disable
        end
        end
    You can also look on the knowledge base of how to enable strong encryption, but this option will make your equipment CPU stress.
    post edited by Arcruz - 2018/08/18 11:20:57
    #6
    Jump to:
    © 2018 APG vNext Commercial Version 5.5