Technical Tip: External threat list (threat feed) blocked via the firewall IPv4 policy

Description

This article describes how to use the external block list.

In FortiOS version v6.2 onwards, the external block list (threat feed) can be added to a firewall policy.
In addition to using the external block list for web filtering and DNS, it can be used in firewall policies.

Scope

FortiOS v6.2+.

Solution

This version includes the following new features:

1. Policy support for the external IP list used as the source/destination address.
2. Support for IPv4 and IPv6 firewall policy only. ACL, DoS, NAT64, NAT46, shaping, and local-in policy are not supported.
3. Support for both CLI and GUI.

Note:

From versions 7.2.4 and 7.4.0, the External Threat Feed object is now additionally supported in local-in policies. It can be added as a srcaddr or a dstaddr. External Threat Feed object adding as a source in the local-in policy is not supported in the v7.0 firmware series.

Configuration.
Go to Security Fabric -> Fabric Connectors -> Threat Feeds -> IP Address, and create or edit an external IP list object.

 

 

Then go to Policy&Objects -> IPv4 Policy, create a new one, and on the destination specify the block list threat feed information.

 

Select 'Apply' so that if the user is trying to access the IP that is listed in the threat feed will deny the connection.

 

Notes:

'set match-vip enable' settings should be enabled on the above policy using CLI in the following situation.

1. Treat feed feature to use block source-ip addresses from WAN to LAN with Source address configured as Blacklist and Destination as all.
2. DNAT / VIP is configured using separate polices to allow traffic from WAN to LAN to access internal resources.

 

A regular deny policy does not block VIP traffic because of the way FortiGate processes the packets. When a packet is destined for a VIP, it undergoes Destination NAT at the beginning of the packet processing, and this means the packet is translated to the VIP's mapped IP before the policy lookup occurs.

 
To create an external IP list object using the CLI.

 

config system external-resource
    edit "test-external-iplist-1"
        set status enable
        set type address
        set username ''
        set password ENC
        set comments ''
        set resource "http://100.100.100.100/ip_list_test/test-external-iplist-2.txt"
        set refresh-rate 15
    next
end

To apply an external IP list object to the firewall policy using the CLI.

 

config firewall policy
    edit 1
        set name "policyid-1"
        set srcintf "wan2"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "test-external-iplist-1"
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next

 

Results.
If users are trying to access the IP list mentioned on the threat feed list, the connection will be dropped.

This will also show logs where the action is 'Deny', which includes 'Deny: policy violation' entries. 

 

 

It is possible to set a filter to display logs related to policy violations on the CLI. The following commands allow filtering logs for denied traffic:

 

execute log filter category 0
execute log filter field action deny
execute log display

 

 

Note:

Before FortiOS version 7.4.4, it was recommended that the maximum size of the text file for the external threat list be approximately 10 MB or 128K entries. After FortiOS version 7.4.4, the limits were defined based on FortiGate models: High-End (Data Center), Mid-Range (Campus), and Entry-Level (Branch). The FortiGate models are described in Technical Tip: Recommended Release for FortiOS, and the limits for each type of list are defined in Threat feeds.

To add an external IP object from CLI on a local-in policy:

 

config firewall local-in-policy

    edit 1

        set uuid 6d2b3266-007f-51ee-a69c-8979765e0d51

        set intf "port3"

        set srcaddr "test-external-iplist-1"    <---  Adding it as a source.

        set dstaddr "all"     <--- It is possible to also add it as a destination.

        set service "HTTP"

        set schedule "always"

    next

end

 

The content of the external feed can be monitored with the following API query:

https://x.x.x.x/api/v2/monitor/system/external-resource/entry-list/USOM/?

access_token=Hnb9ccdd17y10xnp7zn1mjtwkQ0nwN where 'USOM' is the name of the external threat feed.

This API query will show both the content of the feed and the latest status of the feed update.

In case of a communication issue, the API query will report the status as an 'error' similar to the

Following example:

The following URL will provide only the status of the External connector without its content it :

https://x.x.x.x/api/v2/monitor/system/external-resource/entry-list/USOM?status_only=true

Remark: In case of communication issues, FortiGate does not receive the updates but preserves the original file.

Below are the steps for configuring a Windows PC as an external server for a threat feed:

1.Navigate to start and search for Turn windows features on or off.

2.Enable IIS(Internet Information service)

3.Navigate to the following path in pc C:\inetpub\wwwroot

4.Create a text file and add entries to that file.

5.Configure the URI link as http://<IP address of PC>/<filename.txt> on fortigate firewall.

Note:

FortiGate does not re-evaluate existing sessions immediately when an external threat feed is updated. Active sessions are re-evaluated after the smaller value of the configured feed refresh-rate or 30 minutes. Refer to the Related articles section for further details and solution if immediate re-evaluation on existing sessions is required. 

Related article:

Technical Tip: Dynamically update FortiOS session list table when the external feed list is being updated