Blocking ICMP from malicious IP

Hi ro_phil

If you have the malicious IP, just create a firewall policy with the malicious IP as source address and action set to deny.

You can create a reputation policy:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IP-reputation-in-policies-and-fallthrough/ta-p/193898?externalID=FD46815

Or you can create a deny policy using these Internet Service Database Objects as source. 

- Botnet-C&C.Server

- Malicious-Malicious

- Malicious-Malicious.Server

- Phishing-Phishing.Server

- Spam-Soamming.Server

- Tor-Exit.Node

In this case, do not forget to "set match-vip enable" on this policy. Has to be done on the CLI.