Visitor III

Question

multiple sessions

8 replies
2612 views

gents,

time to time, my fortigate have thousands of sessions see below from screenshot. how to find root cause, how to stop these multiple sessions ? 10.100.10.25 - is our mail server. Currently I am terminating manually.

FortiGate

Hong_FTNT

Staff & Editor

Hi @Umirzak,

Are you expecting outbound traffic from the mail server to those IPs? If not, you can block it using firewall policy.

Regards,

UmirzakAuthor

Visitor III

everytime different IPs (

UmirzakAuthor

Visitor III

this is another example

srajeswaran

Staff

Is all the sessions are destined to IP in Indonesia ? If so, we can create an address entry for Indonesia and block all these connections till we find the root cause.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Inbound-Access-from-Specific-Country-IP/ta-p/264818
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-by-country-or-geolocation/ta-p/196741

UmirzakAuthor

Visitor III

unfortunately didn't help, different countries, different IPs. gents, can you help me please.

UmirzakAuthor

Visitor III

no i don't have fortimail and dynamic dns.

yesterday i just closed all ports from DMZ to WAN except mail service ports. looks OK, but i still dont find root cause

UmirzakAuthor

Visitor III

I've hardened my mail server. look like issue resolved.

Sign up

Login with SSO

Login to the community

Login with SSO