FortiAnalyzer open ports

Incoming ports
Purpose		Protocol/Port
FortiAP-S	Syslog, OFTP, Registration, Quarantine, Log & Report	TCP/514
	Event Logs	UDP/5246
FortiClient	Logs from FortiClient for Chromebook	TCP/8443
	Logs from FortiClient (FortiClient must connect to FortiGate or EMS to send logs to FortiAnalyzer)	TCP/514
FortiGate	Syslog, OFTP, Registration, Quarantine, Log & Reports	TCP/514
FortiMail	Syslog	UDP/514
FortiManager	Syslog & OFTP	TCP/514, UDP/514
	Registration	TCP/541
FortiPortal	API communications (JSON and XML APIs respectively)	TCP/443, TCP/8080
Others	SSH CLI Management	TCP/22
	Web Admin	TCP/80, TCP/443
	REST	TCP/443
	DC Polling	TCP/445
	Logg Agg	TCP/3000

 

Outgoing ports
Purpose		Protocol/Port
FortiGuard	AV/IPS, SMS, FTM, Licensing, Policy Override, RVS, URL/AS Update	TCP/443
FortiPortal(FortiPortal only receives log communications from FortiAnalyzer when it is acting as a collector)	Log communications	TCP/514, UDP/514
3rd-Party Servers	LDAP & PKI Authentication	TCP/389, UDP/389
	Log & Report	TCP/21, TCP/22
	Configuration Backups	TCP/22
	Alert Email	TCP/25
	DNS	UDP/53
	NTP	UDP/123
	SNMP Traps	UDP/162
	Report Query	TCP/389
	Syslog & OFTP	TCP or UDP/514
	RADIUS	UDP/1812

FortiAnalyzer uses the following URL to access the sprite map: productapi.fortinet.com Note that productapi.fortinet.com resolves to 96.45.36.123 or 208.91.114.142.