Skip to main content
scheuri
scheuri
Explorer III
February 24, 2022
Solved

External BotNet Lists in AMP Profil or IPS Sensor?

  • February 24, 2022
  • 1 reply
  • 2114 views

Hello all

 

Is it possible to add (external/thirdparty) lists of BotNet IP addresses in the AMP/AV profile or the IPS sensor?

 

As far as I can see it is possible to add thirdparty/external AV-Lists, however, I am not sure if AMP/AV does check IP addresses or if those thirdparty/external AV-Lists need to be AV signatures.

As far as I can see there is no option in the IPS profile/sensor to add external lists.

 

So my best guess at the moment is, that it this is no possible - did someone do this by any chance and can confirm that it indeed might be possible?

 

Thanks a lot, much appreciated

Best answer by AlexC-FTNT

Starting with FortiOS 6.2, you can add an external list of IPs or domains that you want to block:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-External-threat-list-threat-feed-blocked-via-the/ta-p/192354?externalID=FD48868

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/9463/threat-feeds

Is this what you are looking for?

1 reply

AlexC-FTNT
Staff
AlexC-FTNTAnswer
Staff
February 26, 2022

Starting with FortiOS 6.2, you can add an external list of IPs or domains that you want to block:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-External-threat-list-threat-feed-blocked-via-the/ta-p/192354?externalID=FD48868

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/9463/threat-feeds

Is this what you are looking for?

    scheuri
    scheuriAuthor
    Explorer III
    February 28, 2022

    Thank you AlexC for both links.

     

    I was indeed not aware that one can use external lists in the firewall policy itself as source or destination.
    The second link I already was aware of and if I am reading that article correctly, then an external threat feed containing IP addresses can be used in the DNS filter (security profile), but none other (such as AV, IPS, etc.).

     

    Thank you for the first linke and for confirming my assumption.
    Much appreciated

      Terms & ConditionsAccessibility statement