IPS - quarantaine device/user if threat has been found

Forum|Forum|10 years ago
January 25, 2016
5 replies
4464 views

Hi Fortinet Tech's!

I have a question regarding IPS ( maybe the full security bundle instead ), if it's possible to quarantaine a user and/or device if there is any threat found between the endpoint / destination.

I know it's possible to de-block a user/device if an administrator quarantaine the user/device by himself. But is it possible to automate this process?

Thanks in advance!

Ralph1973

New Member

Hello,

Yes you can set the IPS sensor to Quarantine the ip, then it is, apart from the host being blocked, also quarantined for the time span you choose.

Regards,

Ralph

razorAuthor

Visitor III

Ralph1973 wrote:
Hello,
Yes you can set the IPS sensor to Quarantine the ip, then it is, apart from the host being blocked, also quarantined for the time span you choose.

Regards,
Ralph

Where can I pick the option to block the Host OR the IP? Of does IPS block both at the same time?

Thanks for the quick answer though!

The situation what I would like to see: if a client visits a malware which is being blocked by IPS, the client will be blocked from the network/internet. At this moment the malicious website gets quarantained by the IPS engine.