Skip to main content
kelv1n
kelv1n
New Member
December 31, 2014
Solved

Can Fortigate download an IP Dynamic Block List that we define?

  • December 31, 2014
  • 2 replies
  • 38643 views

Hi

 

We're considering swapping out our Palo Altos for Fortigate, one very useful feature on the Palo Alto's is 

its Dynamic Block List, which can download a text file filled with IPs/CIDR from our server which are then added to the Firewalls block list (blocks are removed each time the list is re-downloaded), this list is generated from a script that correlates all the different IP threat lists, such as DShield, Shadow Server etc.

 

How can we achieve this with Fortigate, i.e. downloading the list adding the IPs to the block list. I've search high and low, but can't see a similar feature.

 

Thanks

    Best answer by Dave_Hall

    There isn't an import feature for IP addresses on the Fortigate, but some forum posters have come up with scripting solutions that will take a text file list of IP address and convert it into something you can import (copy/paste) into the Fortigate's config (via CLI or text editor).  The linked thread (above) is just one example -- use the search function above this page to search for other scripting solutions.

     

    The Fortigates have hard-coded max values for various features, including firewall objects, which is where you define IP addresses.  If we are talking about a list of 1000s of IP addresses, you will want to divide them into groups of 300 or so IP addresses (e.g. IPgroup1, IPgroup2, IPgroup3, etc) -- this is strictly to make the IP addresses manageable when you create the firewall policy to block these addresses.

     

    Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

    2 replies

    Dave_Hall
    Dave_HallAnswer
    New Member
    December 31, 2014

    There isn't an import feature for IP addresses on the Fortigate, but some forum posters have come up with scripting solutions that will take a text file list of IP address and convert it into something you can import (copy/paste) into the Fortigate's config (via CLI or text editor).  The linked thread (above) is just one example -- use the search function above this page to search for other scripting solutions.

     

    The Fortigates have hard-coded max values for various features, including firewall objects, which is where you define IP addresses.  If we are talking about a list of 1000s of IP addresses, you will want to divide them into groups of 300 or so IP addresses (e.g. IPgroup1, IPgroup2, IPgroup3, etc) -- this is strictly to make the IP addresses manageable when you create the firewall policy to block these addresses.

     

    Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

    kelv1n
    kelv1nAuthor
    New Member
    December 31, 2014

    Dave Hall wrote:

    Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

     

    Thanks Dave, thats a good idea. Its more to do with our SIEM solution monitors the different threats lists and then compares that against traffic hitting our Firewalls, so we've integrated those lists into our security management. But our Market is only UK based, so blocking by country is a good alternative.  I might also look into an API option, or scripting it via SSH.

     

    fwadm342
    fwadm342
    New Member
    February 26, 2018

    Hello,

        Since it's been awhile, I thought I'd follow up...has there been any update to this functionality?  Can you import an external list of IP addresses to block in the firewall, or is it all still manually done?

     

    Thanks...

    fernandezm_FTNT
    Staff
    fernandezm_FTNT
    Staff
    April 14, 2018

    This is now available in 6.0.

     

    I created a blog post on my personal blog.  

    fwadm342
    fwadm342
    New Member
    May 1, 2018

    I was just reading the documentation (specifically, page 2475 of the FortiOS 6.0 handbook), and it says the limits on an external dynamic block list are either 128K lines, or 10M in size.     My question is - is that total for all external dynamic block lists, or just a single block dynamic list?  And if that's per each dynamic block list, how many external dynamic block lists can you import into your firewall?

     

    thanks...

    emnoc
    emnoc
    New Member
    May 1, 2018

    Op, don't know but have you  checked out  any max metrics values?

     

    BTW: I wrote a sample  the external resource list on my blog also

     

    http://socpuppet.blogspot.com/2018/04/using-fortios-external-resource-list.html

    We will be using it for URL filtering and a simple caddyServer.

     

    Terms & ConditionsAccessibility statement