Port and access control information
This topic contains information about the default ports by interface as well as the endpoints that need to be reachable by FortiSandbox.
Default Ports
The following section provides information about ports by interface, ports by FortiSandbox model, and ports by configuration.
*For more information, see Air Gapped Mode.
Ports by interface
The following table lists the services and ports for each FortiSandbox interface.
|
Interface |
Services and Ports |
|---|---|
| Port1 | Default for inbound traffic for Administration TCP ports 22 (SSH), 23 (Telnet), 80 and 443 (GUI). |
| Port3 |
Reserved for the outgoing traffic initiated by the guest VMs. For effective detection of 0-day, we strongly suggest to directly connect Port3 to the Internet via a perimeter firewall. Also, make sure that connectivity is isolated from your Intranet (internal network) to prevent lateral movement. If connected directly to a FortiGate device, make sure that the egress WAN interface does not have the Scan Outgoing Connections to Botnet Sites feature enabled, nor any active security profiles as this can affect the detection rate. |
|
All ports except Port3 |
Inbound: The following services define the ports for inbound:
Outbound: The following services define the ports for outbound. The interface of the services is based on the static route configuration:
|
| Cluster ports (all other ports except Port1 and Port3) | In cluster mode, FortiSandbox uses TCP ports 2015 and 2018 for cluster internal communication. If the unit works as a Collector to receive threat information from other units, it uses TCP port 2443. |
|
All ports mentioned above are the same for both IPv4 and IPv6 protocols. For redundancy and increase throughput, consider setting up Aggregate interface. See, Create an aggregate interface. For any outgoing traffic, FortiSandbox uses a random port picked by the kernel. You can dynamically change the system firewall rules using the |
The following table lists the available ports for each FortiSandbox model.
|
Interface Type |
3000F/3000E/2000E/1500G |
1000F |
500G/500F |
|---|---|---|---|
| RJ45 | Port 1-4 | Port 1-4 | Port 1-4 |
| SFP GbE | Port 5-8 | ||
| SFP+ | Port 5-6 |
Access Control List
The table below provides the default servers and options when configured. For further info on the services, refer to the notes column. We recommend periodically checking these entries for changes.
| Services | Destination | Notes |
|---|---|---|
| FortiGuard Distribution Network (FDN) | ||
| Database and Engine Download |
fds1.fortinet.com:8890/TCP When configured to override region:
|
Default is Nearest. Configurable. For more information, see FortiGuard > FortiGuard Server Location in the FortiSandbox Administration Guide. |
| Web Filtering Service |
securewf.fortiguard.net:53|8888/TCP When configured to override region: 53|443|8888/TCP List of FQDN and IP Addresses:
|
Default is Nearest. .IP address is valid when Secure Connection is enabled. When Secure Connection under FortiGuard Web Filter Settings is disabled, replace the TCP with UDP. For more information, see FortiGuard > Secure Connection in the FortiSandbox Administration Guide. |
| FortiSandbox | ||
| Community Cloud Query | fqsvr.fortinet.net:53/UDP |
For more information, see Scan Profile Advanced Tab > Community Cloud Query. Available only in Global (Canada). |
| Community Cloud Upload |
fortinetvirussubmit.com:25/TCP or 465/TCP or 587/TCP |
For more information, see Scan Profile Advanced Tab > Upload malicious and suspicious file in the FortiSandbox Administration Guide. Available only in Global (Canada). |
| Rating Cloud Service (RSE) | fqdl.fortinet.net:443/TCP |
For more information, see Scan Profile Advanced Tab > Enable Rating Cloud Service. Available only in Global (Canada). |
| Windows Cloud VM Service |
aptctrl1.fortinet.com:443/TCP or 514/TCP List of IP Addresses:
|
Initially download a list of IP via the APTCTRL1 as configured on WindowsCloudVM Settings. For more information, see FortiGuard > WindowsCloudVM Settings in the FortiSandbox Administration Guide. |
| macOS Cloud VM Service | mac.fortisandbox.net:443/TCP or mac2.fortisandbox.net:443/TCP | Available only in Global (Canada). |
| VM Images Service | fsavm.fortinet.net:443/TCP | Uses GeoIP to select between two regions for faster download speed of the VM images. Available in Global (Canada) and Germany. |
|
Real-Time Zero-Day Anti-Phishing Service Settings |
canwest.ucs.fortiguard.com:443|8084/TCP
|
Download a list of IPs via the canwest.ucs.fortiguard.com. For more information, see Scan Profile Advanced Tab > Enable Real-time Zero-Day Anti-Phishing Service |