Technical Tip: How to block illegitimate devices on FortiAnalyzer

At FortiAnalyzer > Device Manager > Devices and groups > Unauthorized devices can request to be added in FortiAnalyzer.

At FortiAnalyzer run the CLI commands:

config sys local-in-policy

    edit 1

        set action drop

        set dport 514

        set protocol tcp_udp

        set src <Not Legit Device IP Address, Eg: 1.2.3.4/32>

    next

end

At FortiAnalyzer, select ‘Delete’ to remove the illegitimate devices.

After that the illegitimate devices will not be able to connect to FortiAnalyzer and FortiAnalyzer’s Unauthorized Devices page will not show the illegitimate devices anymore.

Note:

It is also possible to block all devices using: set detect-unregistered-log-device {enable | disable}