Blocking ICMP from malicious IP

2 replies
2860 views

Hi All,

I have a question related to blocking ICMP from a malicious IP on the FortiGate.

We have allowed ICMP to one of our sever from external. We see that ICMP was allowed from a malicious IP though it was categorized by FGD as malware. We have all the security profiles enabled for the VIP policy in FGT.

Is there a way to block ICMP from malicious IP's?

Thanks!

ESCHAN_FTNT

Staff

Hi ro_phil

If you have the malicious IP, just create a firewall policy with the malicious IP as source address and action set to deny.

brudy

New Member

You can create a reputation policy:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IP-reputation-in-policies-and-fallthrough/ta-p/193898?externalID=FD46815

Or you can create a deny policy using these Internet Service Database Objects as source.

- Botnet-C&C.Server

- Malicious-Malicious

- Malicious-Malicious.Server

- Phishing-Phishing.Server

- Spam-Soamming.Server

- Tor-Exit.Node

In this case, do not forget to "set match-vip enable" on this policy. Has to be done on the CLI.

Sign up

Login with SSO

Login to the community

Login with SSO