Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

Marcde_J
New Contributor II

Increasing amount of Intrusion attempts

Hi, I have a 100E protecting a corporate HO with about 500 devices behind it.

We have 9 public addresses. In the last two weeks we went from having about 2 IPS events a week to 200 every day.

Is there a way to curb this? At the moment I put every IP on an ACL list preventing future attempts from that specific IP, but it just seems to be getting worse?

Attached latest IPS log for info

1 REPLY 1
DeepKuma2
Contributor

Hi,

I saw some "Backdoor.DoublePulsar" in the logs. Is it VIP configured for this system? 

Current action is blocked on the firewall but it is also recommended to verify the DOS, DDOS configuration and Antivirus scanning with SSL along with IPS. 

Offcourse it is critical to the point of security but if you are using well-configured security solution as FortiGate and all client machines are up to date with patches, antivirus, host firewall etc. then don't worry.

 

 

Regards,

Deepak Kumar

Deepak Kumar First Option General Trading LLC Dubai
Deepak Kumar First Option General Trading LLC Dubai