Technical Tip: How to block the web access using the external resources on FortiGate

The external resource in remote HTTP/HTTPS server must meet the following conditions:

• The external resource file will be a plaintext format file, and each URL will be in a single line.
• Each line can be an IP address or a subnet.
• The file is limited to 10M.
• The maximum number of lines is limited to 128K (128 x 1024 entries).
• The line length limit is 4K characters.
• The entries are also limited by the table size limitation defined by CMDB per model.

Example configuration via CLI:

config system external-resource
    edit "External-resource-files"
        set type address
        set resource "http://10.104.3.130/resources/urls"
        set refresh-rate 2
    next
end

Note: FortiGate will connect to the remote HTTP server every 2 minutes (set refresh-rate 2) for automatic updates. The default value of refresh-rate is 5 minutes but the value can be set between 1 and 43200. 

config dnsfilter profile
    edit "default"
        set external-ip-blocklist "External-resource-files"
    next
end

In order to see the external resource database on FortiGate, run the below command via CLI:

FortiGate # fnsysctl ls -l /var/log/external/

-rw-r--r-- 1 0 0 Mon Apr 25 04:15:19 2022 15762 ext-root.External-resource-files
-rw-r--r-- 1 0 0 Mon Apr 25 04:15:19 2022 33 ext-root.External-resource-files.csum
-rw-r--r-- 1 0 0 Mon Apr 25 04:15:19 2022 35 ext-root.External-resource-files.etag

Note: In an HA cluster, the external resource database is getting synced between slave units. An HA log message appears that states that the HA members are out-of-sync due to 'external-files'. This log will be generated when FortiGate starts to get the latest URL or IP list from the remote HTTP or HTTPS server:

date=2022-04-25 time=04:15:41 id=7090343938808087133 itime="2022-04-25 04:15:43" euid=3 epid=3 dsteuid=3 dstepid=3 logver=700020234 logid=0108037903 type="event" subtype="ha" level="information" msg="The sync status with the primary" logdesc="Synchronization status with primary" sync_type="external-files" sync_status="out-of-sync" eventtime=1650849342264133363 tz="+0300" devid="FG1K5DT365987569" vd="root" dtime="2022-04-25 04:15:41" itime_t=1650849343 devname="FW1"

Related documents:
External resources for web filter - FortiGate cookbook

Troubleshooting Tip: The external resource contains more entries than is supported