Making FortiGate completely invisible to probes

最新推荐文章于 2006-10-29 17:43:00 发布

gotonet

最新推荐文章于 2006-10-29 17:43:00 发布

阅读量1k

点赞数

CC 4.0 BY-SA版权

分类专栏： fortinet 文章标签： interface tcp exception command delay service

本文链接：https://blog.youkuaiyun.com/gotonet/article/details/1355744

fortinet 专栏收录该内容

35 篇文章

订阅专栏

默认情况下，FortiGate设备除TCP 443端口外不接受任何TCP或UDP连接，以增强安全性。本文介绍如何通过CLI命令在指定接口上禁用TCP 113端口的自动重置功能，以提高隐身性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

FortiGate units by default do not accept TCP or UDP connections on any port (except TCP port 443 HTTPS connections on the default internal interface for administration). This reduces the possibility of attacks such as Denial of Service (DoS) as the unit's ports cannot be discovered by probing.

An exception to this "stealth" configuration is TCP port 113 (Ident/Auth). By default, this port returns a RST packet to reset the connection. This avoids the delay that occurs if the server making the ident request waits for the request to time out.

The ident port is less used today. If you would prefer to have your FortiGate unit completely invisible to probes at the cost of occasional delays, you can turn off the automatic reset of TCP port 113 connections.

FortiGate unit - all models
FortiOS firmware - version 2.8 MR11 and later, version 3.0

Execute the set ident-accept enable CLI command on each interface where you want to turn off the automatic reset of TCP port 113 connections. For example, to do this on port1:

  config system interface
    edit port1
      set ident-accept enable
    end
  end