Appendix C: Port Numbers
Firewalls (if any) between FortiMail and other devices may need to open the following inbound (listening) and outbound ports in order to communicate with other devices. Required port numbers vary by which features you enable.
Default port numbers are listed. Many are configurable. See the links in each row of:
|
In its factory default configuration, FortiMail does not accept packets on any port except port1 and port2 network interfaces, which only accept:
|
Incoming (listening) port numbers
FortiMail features listen for communications from other devices on these ports.
If port forwarding is enabled, then the FortiMail unit listens on more port numbers that are not associated with FortiMail features, but instead are forwarded to other devices on the network. See Configuring port forwarding. If traffic capture is enabled, then the FortiMail unit listens on port numbers that are specified by the filter. See Traffic capture.
|
Default Port Number |
IP Protocol |
Source IP address |
Purpose |
|---|---|---|---|
|
80 |
TCP |
|
|
|
443 |
TCP |
||
|
22 |
TCP |
|
|
|
23 |
TCP |
|
|
|
161 |
UDP |
|
SNMPquery |
|
25 |
TCP |
|
|
|
465 |
TCP |
|
|
|
587 |
TCP |
|
Email sending (SMTP for email users to send email separately from relays/servers) |
|
143 |
TCP |
|
|
|
993 |
TCP |
|
|
|
110 |
TCP |
|
|
|
995 |
TCP |
Email (POP3S; server mode only) |
|
|
443 |
TCP |
|
|
|
6688 |
TCP |
||
|
20000 |
UDP and TCP |
HA heartbeat signal (base port) | |
|
20001 |
UDP and TCP |
||
|
20002 |
TCP |
HA file synchronization | |
|
20003 |
TCP |
HA data synchronization | |
|
20004 |
TCP |
HA checksum synchronization | |
|
20005 |
UDP and TCP |
HA cluster join request |
|
|
20010-20014 |
UDP and TCP |
||
|
25 |
TCP |
HA service monitoring (SMTP) | |
|
80 |
TCP |
HA service monitoring (HTTP) | |
|
110 |
TCP |
HA service monitoring (POP3) | |
|
143 |
TCP |
HA service monitoring (IMAP) | |
|
9443 |
UDP |
(Deprecated) FortiGuard Antivirus push |
|
|
443 |
TCP |
|
Security Fabric (HTTPS management) |
Outgoing port numbers
FortiMail communicates to these port numbers on other servers and devices.
|
Default Port Number |
IP Protocol |
Destination IP Address |
Purpose |
|---|---|---|---|
|
443 |
TCP |
|
Authentication (HTTPS SAML SSO) |
|
389 |
TCP and UDP |
Authentication (LDAP) |
|
|
636 |
TCP |
Authentication (LDAPS) |
|
|
1812 |
TCP |
Authentication (RADIUS) |
|
|
143 |
TCP |
|
Authentication (IMAP) |
|
993 |
TCP |
Authentication (IMAPS) |
|
|
110 |
TCP |
Authentication (POP3) |
|
|
995 |
TCP |
Authentication (POP3S) |
|
|
25 |
TCP |
||
|
465 |
TCP |
||
|
21 |
TCP |
|
Backup of configuration (FTP) |
|
22 |
TCP |
Backup of configuration (SFTP/SSH) |
|
|
22 |
TCP |
Backup of mailboxes (SFTP/SSH) |
|
|
445 |
TCP and UDP |
Backup of mailboxes (SMB/CIFS) |
|
|
3260 |
TCP |
Backup of mailboxes (iSCSI) |
|
|
2049 |
TCP and UDP |
Backup of mailboxes (NFS) |
|
|
2049 |
TCP and UDP |
External storage for mailboxes and quarantine (NFS) |
|
|
3260 |
TCP |
External storage for mailboxes and quarantine (iSCSI) |
|
|
443 or 8890 |
TCP |
|
|
|
53 or 8888 |
UDP or TCP |
FortiGuard Antispam rating query |
|
|
53 |
UDP |
|
Third-party DNSBL/RBL spam rating query |
|
53 |
UDP |
|
Third-party SURBL URL rating query |
|
53 |
UDP |
|
|
|
123 |
UDP |
|
Time synchronization (NTP) |
|
443 |
TCP |
|
|
|
6688 |
TCP |
||
| 20000 |
UDP and TCP |
HA heartbeat signal (base port) | |
| 20001 |
UDP and TCP |
||
| (20002 |
TCP |
HA file synchronization |
|
|
20003 |
TCP |
HA data synchronization |
|
| 20004 |
TCP |
HA checksum synchronization |
|
|
20005 |
UDP and TCP |
HA cluster join request |
|
|
20010-20014 |
UDP and TCP |
||
| 25 |
TCP |
HA service monitoring (SMTP) | |
| 80 |
TCP |
HA service monitoring (HTTP) | |
| 110 |
TCP |
HA service monitoring (POP3) | |
| 143 |
TCP |
HA service monitoring (IMAP) | |
| 514 |
TCP |
Centralized quarantine (clear text) | |
| 6514 |
TCP |
Centralized quarantine (secure) | |
|
8013 |
TCP |
|
|
|
443 |
TCP |
|
|
|
443 |
TCP |
|
URL scan (HTTPS) |
|
514 |
TCP |
File scan (OFTPS) |
|
|
443 |
TCP |
|
Registration, configuration backup/pull, and firmware pull |
| 162 |
UDP |
Event traps (SNMP) | |
| 514 |
UDP and TCP |
|
Logging |
|
80 or 443 |
TCP |
|
Dynamic DNS (HTTP or HTTPS) |
|
80 and 443 |
TCP |
|
Resolution of URL redirects (for example, tiny URLs) into the target URL |
|
80, or port number in OCSP certificate |
TCP |
|
Certificate revokation query |
Required URLs for FortiGuard services
Firewalls and web filters between the FortiMail unit and the Internet must allow requests to the following URLS, which are used by FortiMail features that connect to Fortinet's FortiGuard services:
- update.fortiguard.net
- securewf.fortiguard.net (global) or securewf.fortiguard.net (United States only)
- service.fortiguard.net (global) or usservice.fortiguard.net (United States only)