how to block bulk public ips in fortigate

Hi Team,

The best way is to use threat feeds.

Please follow this article for the same:

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/9463/threat-feeds
You can use this article for the same.

You require webserver where you need to host one text file with all those ip address.

Dear Umesh,

You can use a Webserver, internal network, or external network, that FortiGate can reach and retrieve the list of IP addresses you have added.

Like in the article below:

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/891236/external-block-list-threat-feed-policy

config system external-resource    edit "test-external-iplist-1"       set status enable       set type address       set username ''       set password ENC        set comments ''       set resource "http://10.6.30.55/ip_list_test/test-external-iplist-2.txt" <---       set refresh-rate 15    next end

 So you can put on the webserver the file that can be reached from HTTP.

Best Regards,

Vasil 

Hi,

One way to block access to your fortigate from the public IPs is to configure a local-in-policy.

For example:

configure address object

config firewall address
edit public_IP_to_block
set subnet 1.1.1.0 255.255.255.0
next
end

If you have multiple subnets to block, You can configure more address-object and make an Address-object group

config firewall local-in-policy

edit 1

set intf wan1
set srcaddr "public_IP_to_block" <--- Address-object or address-object-groupe
set dstaddr All <--- it can be all or you can define any address group ( like for block access to WAN1, configure an address-object for that WAN IP)
set action deny
set service All
set schedule "always"

end

Hi Mahboob,

I have around 5000 IPs which has to be blocked in the Fortinet firewall, you know is it possible to block them one by one, as I know it is very tough work for me. do you have any feasible solution ???

for it.