Skip to main content
Mirza_Asad2723
New Member
July 5, 2024
Question

How to Block Source IP when detect port scan for 10 minutes

  • July 5, 2024
  • 3 replies
  • 1958 views

Dear Concern,

I was saw that someone can try nmap port scanning to findout the open ports or services via WAN side or LAN side and then he attempt the attacks like brute force etc. Can you help me that how can I find the source IP of attacker and how can i configure to block this IP for 10 minutes while he can try port scan automatically. 

 

Thanks and waiting for your helpful appreciable response.

3 replies

mpapisetty
Staff
Staff
July 5, 2024

Hi @Mirza_Asad2723 ,

The DoS Policy takes care of such attacks. Here is an overview of the same - 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/771644/dos-policy

 

Mirza_Asad2723
New Member
July 5, 2024

Thanks for your prompt response

I already configured it but when i tried to check nmap port scan via ubuntu so it shows all ports are open so thats why i need to configure that when the attacker attempt nmap port scan so his IP address will be block for defined time like 10 minutes. 

hbac
Staff
Staff
July 5, 2024

Hi @Mirza_Asad2723,

 

What is the destination IP of the scan? 

 

Regards, 

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!