Is useful block by country?

Forum|Forum|10 years ago
July 1, 2016
2 replies
4322 views

For example: The Fortigate 500D IOS 5.2.3

Hi, searching in the 500D reports and I repetitive attack from some country, so the quetions: Is useful block by country? For example in first policy :

src: "Netherlands" dst: All

Thanks.

5.2

Best answer by emnoc

Yes but that can kill legit traffic also if for say you had clients from Netherlands. What I would b4 I GEO-IP block;

1: monitor for legit traffic from the region your planning to block

2: set log on the block policy after you enable block to see what's being blocked

3: monitor and re-monitor

Alternatively you could probably do a IPS rule and a set quarantine or ban action for the SRCs that hit the IPS rule, this is more friendly and would not strike legit SRCs

emnocAnswer

New Member

Yes but that can kill legit traffic also if for say you had clients from Netherlands. What I would b4 I GEO-IP block;

1: monitor for legit traffic from the region your planning to block

2: set log on the block policy after you enable block to see what's being blocked

3: monitor and re-monitor

Alternatively you could probably do a IPS rule and a set quarantine or ban action for the SRCs that hit the IPS rule, this is more friendly and would not strike legit SRCs

condorAuthor

New Member

Hi Emnoc , i'm brand new in IPS , I understand the concept , but where I can create IPS rules? I found only create signatures on FortiGate manuals. Could you please indicate some of documentations about it?

Thanks a lot for your help.

Sign up

Login with SSO

Login to the community

Login with SSO