Best way to detect and block internal bad-actors

Question

We have a primary Fortigate that is used to control Internet access for several retirement communities across several campuses. We have traffic from all sites Hide-NAT’d to different IPs based on the type of traffic. Guest/public access from all sites get NAT’d to this IP, internal residents get NAT’d to that IP. Internal systems get NAT’d to a different public IP still. This helps when someone on the internal network has a system which has been compromised and is causing one of our public IPs to get blacklisted.

However it is still a problem when one of our public IPs gets blacklisted because a system is doing something it shouldn’t. What is the best way on the Fortigate to identify problematic internal systems (particularly spam sources), and block their IP from being allowed public access?

osoleimani · Answer

Hi Derek,Your NAT design makes sense for separating the different traffic groups, but the important part here is being able to identify the original internal source when one of the shared public IPs becomes compromised or blacklisted.I would start with FortiView Sources and FortiView Sessions and investigate the internal source IPs generating the suspicious outbound traffic. FortiOS traffic logs retain the original source IP as well as the NAT IP, so you can correlate the public/NAT address back to the internal system responsible for the traffic.For your particular concern about spam sources, I would also look specifically at outbound SMTP traffic (TCP/25) and identify which internal source is generating those sessions. FortiView allows you to filter sessions by source, destination and port and drill down into the associated session logs.Once the problematic internal host has been identified, I would recommend isolating it with a more specific firewall policy placed above the general Internet access policy. This allows you to block that internal source from using the Internet/NAT while leaving the other systems sharing the same public IP available.If your environment includes FortiClient EMS, FortiSwitch/FortiAP, or FortiNAC, you can also take this a step further. FortiOS supports a Compromised Host Quarantine automation workflow that can quarantine a detected endpoint rather than relying only on a firewall policy.So I would approach this as: identify the internal source → correlate it with the affected NAT/public IP → contain that specific host → investigate/remediate the endpoint. This avoids unnecessarily blocking the entire group of users sharing the same public IP.Hope this helps.

Sign up

Login with SSO

Login to the community

Login with SSO