Opening ports in the security group
By default, when you deploy FortiGate, there is a predefined security group that you can select based on Fortinet's recommendation. The following ports are allowed in the predefined security group assuming immediate and near-future needs.
|
|
Protocol/ports |
Purpose |
|---|---|---|
|
Incoming |
TCP 22 |
SSH |
|
|
TCP 80 |
HTTP |
|
|
TCP 443 |
HTPS, management GUI access to FortiGate |
|
|
TCP 541 |
Management by FortiManager located outside AWS |
|
|
TCP 3000 |
Not immediately required, but typically used for incoming access to web servers, and so on |
|
|
TCP 8080 |
|
|
Outgoing |
Any |
|
FortiGate-specific open ports are explained in Fortinet Communication Ports and Protocols.
To configure bare-minimum access that gives the most strict incoming access, allow only TCP 443 to access the FortiGate GUI console as mentioned in Connecting to the FortiGate and close all other ports. You may want to allow ICMP for pinging, and so on, as needed.