New Member

Solved

Detect HTTP return code 401 and block IP

Forum|Forum|1 year ago
September 3, 2024
6 replies
2633 views

Hello,

we are using Fortiweb VM version 7.0.8 and i'm not specialist in the system. Our Exchange server is behind the fortiweb. We have a lot of attempt to connect to the exchange using EWS.

I can see in the Traffic (Log & Report) for attempts and the return code is 401 (forbidden).
My question : Is it possible to create a rule/policy to automatically block IP for all attempt getting the Return code 401?

Thank you

FortiWEB

Best answer by ComprAF2024

Hello,

In fact our Fortiweb was configured by an external provider.

I finally found my way:

Created Custom Policy
Create Web protection (Policy - Web Protection Profil) profil and assign Custom Policy
Apply Web Porection profil to the Server Policy

All working as expected !

AEK

SuperUser

Hi

I'm used to integrate and administer FortiWeb but I personally don't know such feature.

And logically talking, since 401 is not actually an attack then I don't think you can do such action in FortiWeb.

AEK

ComprAF2024Author

New Member

Hello,

in fact to develop our problem, we can see theses errors in the traffic logs: It's all connection attempt to our Exchange using EWS. We can see the return code 401

I found a way to normally block this by creating a new custom policy:

But this rule seems not block anythings.

Can you help me?

Thank you

Hatibi

Staff & Editor

Hello,

you can try to blacklist the source IP and Fortiweb should present a general error page.

https://docs.fortinet.com/document/fortiweb/7.6.0/administration-guide/811256/ip-list-blocklisting-whitelisting-clients-using-a-source-ip-or-source-ip-range

Blocklisted IPs—Blocked and prevented from accessing your protected web servers. Requests from Blocklisted IP addresses receive a warning message as the HTTP response. The warning message page includes ID: 70007, which is the ID of all attack log messages about requests from Blocklisted IPs.

There is also the option to customize http responses to show less about the error:

https://docs.fortinet.com/document/fortiweb/6.1.1/administration-guide/481808/customizing-error-and-authentication-pages-replacement-messages#top

ComprAF2024Author

New Member

Hi ,

thank you. In fact theses attacks are from a lot of differents ip. I suppose doing by bots.

It will be not usefull to blacklist ip by hand.

It's why automatically block when Fortiweb detect a forbidden message could be very good for the security.

Have you an idea to how troubleshoot this?

Thank you very much

ComprAF2024AuthorAnswer

New Member

Hello,

In fact our Fortiweb was configured by an external provider.

I finally found my way:

Created Custom Policy
Create Web protection (Policy - Web Protection Profil) profil and assign Custom Policy
Apply Web Porection profil to the Server Policy

All working as expected !

Sign up

Login with SSO

Login to the community

Login with SSO