Skip to main content
blason
blason
New Member
December 27, 2017
Question

Can we roll out 5000 null routes at a moment?

  • December 27, 2017
  • 1 reply
  • 3290 views

Hi Guys,

 

I need to know if we can roll out or script bulk routing. That is I need to add certain malicious IPs may be 5000/6000 in numbers and need to add null route for those to block.

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    December 28, 2017

    hi,

     

    that depends on your hardware and the version of FortiOS used.

    For example, http://help.fortinet.com/fgt/54/max-values/5-4-6/max-values.html shows the hardcoded limits for "static routes" as 500 for a 100D, 10.000 for a 600D. Same limits apply for FOS v5.6.3 (but this is not always the case).

     

    You can check the currently implemented value on your hardware as well.

    Type "print tablesize" in the CLI, and look for the line containing "router.static". 'grep' unfortunately doesn't work in this context.

     

    Using (and maintaining!) 5.000 blackhole routes is cumbersome to say the least. Why not trust FortiGuard botnet and malicious sites' IP lists which are updated continuously?

    emnoc
    emnoc
    New Member
    December 28, 2017

    Agreed, managing   BH-routes or address group is not  effective.

     

    Ken

     

    Terms & ConditionsAccessibility statement