Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Required services and ports

You must ensure required port and services are enabled for use by FortiClient and its associated applications on your server. The required ports and services enable FortiClient to communicate with servers running associated applications.

Communication

Usage

Protocol

Port

Incoming/Outgoing

How to customize

FortiClient Telemetry

Endpoint management (EMS), participation in the Security Fabric (FortiGate)

TCP

8013

Outgoing

GUI

SYSLOG

Upload logs to syslog server

UDP

514

Outgoing

N/A

FortiSandbox

Send files to FortiSandbox for analysis

TCP

514

Outgoing

N/A

Remote access - SSL VPN

Establish VPN connection to the FortiGate

TCP

443 (default)

Outgoing

GUI

FortiAnalyzer/FortiManager

Upload logs to FortiAnalyzer or FortiManager

TCP

514

Outgoing

N/A

Remote access - IPsec VPN

Establish VPN connection to the FortiGate

UDP

IKE 500 ESP (IP 50) NAT-T 4500

Outgoing

N/A

FortiAuthenticator/FortiGate

SSO mobility agent, FortiClient SSO (FSSO)

TCP

8001 (default)

Outgoing

GUI

FortiManager

Use a FortiManager for FortiClient software and signature updates

TCP

80 (default)

Outgoing

GUI

SMTP/FortiGuard

Virus submission

TCP

25

Outgoing

N/A

FortiClient connects to FortiGuard to query for URL ratings for Web Filtering and to download AV and vulnerability scan engine and signature updates. FortiClient can connect to legacy FortiGuard or FortiGuard Anycast. The EMS administrator configures FortiGuard server options. See Web Filter and System Settings. The following table summarizes required services for FortiClient to communicate with FortiGuard:

Usage

 

Server URL

Protocol

 

Port

 

Incoming/Outgoing

 

How to customize

Global

U.S.

Europe

URL rating

fgd1.fortigate.com

usfgd1.fortigate.com

N/A

TCP

8888 (default)

Outgoing

Change to UDP via XML. See the FortiClient XML Reference Guide.

URL rating with FortiGuard Anycast

fctguard.fortinet.net

fctusguard.fortinet.net

fcteuguard.fortinet.net

TCP

443

Outgoing

Change to UDP via XML. See the FortiClient XML Reference Guide.

AV/vulnerability signature update

forticlient.fortinet.net

usforticlient.fortinet.net

N/A

TCP

80

Outgoing

N/A

AV/vulnerability signature updates with FortiGuard Anycast

fctupdate.fortinet.net

fctusupdate.fortinet.net

fcteuupdate.fortinet.net

TCP

443

Outgoing

N/A

Cloud-based behavior scan (CBBS)/applications that use cloud services

N/A

N/A

N/A

TCP

80

Outgoing

N/A

note icon

For the list of required services and ports for EMS, see the FortiClient EMS Administration Guide.

Required services and ports

You must ensure required port and services are enabled for use by FortiClient and its associated applications on your server. The required ports and services enable FortiClient to communicate with servers running associated applications.

Communication

Usage

Protocol

Port

Incoming/Outgoing

How to customize

FortiClient Telemetry

Endpoint management (EMS), participation in the Security Fabric (FortiGate)

TCP

8013

Outgoing

GUI

SYSLOG

Upload logs to syslog server

UDP

514

Outgoing

N/A

FortiSandbox

Send files to FortiSandbox for analysis

TCP

514

Outgoing

N/A

Remote access - SSL VPN

Establish VPN connection to the FortiGate

TCP

443 (default)

Outgoing

GUI

FortiAnalyzer/FortiManager

Upload logs to FortiAnalyzer or FortiManager

TCP

514

Outgoing

N/A

Remote access - IPsec VPN

Establish VPN connection to the FortiGate

UDP

IKE 500 ESP (IP 50) NAT-T 4500

Outgoing

N/A

FortiAuthenticator/FortiGate

SSO mobility agent, FortiClient SSO (FSSO)

TCP

8001 (default)

Outgoing

GUI

FortiManager

Use a FortiManager for FortiClient software and signature updates

TCP

80 (default)

Outgoing

GUI

SMTP/FortiGuard

Virus submission

TCP

25

Outgoing

N/A

FortiClient connects to FortiGuard to query for URL ratings for Web Filtering and to download AV and vulnerability scan engine and signature updates. FortiClient can connect to legacy FortiGuard or FortiGuard Anycast. The EMS administrator configures FortiGuard server options. See Web Filter and System Settings. The following table summarizes required services for FortiClient to communicate with FortiGuard:

Usage

 

Server URL

Protocol

 

Port

 

Incoming/Outgoing

 

How to customize

Global

U.S.

Europe

URL rating

fgd1.fortigate.com

usfgd1.fortigate.com

N/A

TCP

8888 (default)

Outgoing

Change to UDP via XML. See the FortiClient XML Reference Guide.

URL rating with FortiGuard Anycast

fctguard.fortinet.net

fctusguard.fortinet.net

fcteuguard.fortinet.net

TCP

443

Outgoing

Change to UDP via XML. See the FortiClient XML Reference Guide.

AV/vulnerability signature update

forticlient.fortinet.net

usforticlient.fortinet.net

N/A

TCP

80

Outgoing

N/A

AV/vulnerability signature updates with FortiGuard Anycast

fctupdate.fortinet.net

fctusupdate.fortinet.net

fcteuupdate.fortinet.net

TCP

443

Outgoing

N/A

Cloud-based behavior scan (CBBS)/applications that use cloud services

N/A

N/A

N/A

TCP

80

Outgoing

N/A

note icon

For the list of required services and ports for EMS, see the FortiClient EMS Administration Guide.