Technical Tip: Automatically quarantine users who repeatedly attempt to access a website blocked by the UTM profiles in FortiGate

[auppal]

Description

This article describes how to block a network user from accessing the internet if the user is trying to access a blocked website. This can be achieved by using a FortiAnalyzer Event Handler in an Automation Stitch on the FortiGate.

Scope

FortiGate, FortiAnalyzer.

Solution

The following prerequisites must be met:

1. FortiAnalyzer is registered and active.
2. FortiGate is connected to the FortiAnalyzer.

Example – User(s) should get quarantined if they are trying to access a blocked social media website multiple times continuously.

1. Configure a FortiAnalyzer Event Handler -
   
   Event handlers can be created in FortiAnalyzer. See the administration guide for instructions.
   1. Make sure the Automation Stitch option is enabled in the Event Handler configuration: Navigate to Incidents & Events -> Handlers -> Basic Handlers -> Create New -> Enable Automation Stitch.

2. Configure the rule for the handler. In this case, important fields to note are Log Device Type, Log Type, Group By, Logs Match, Aggregation Duration and Aggregation Expression -> Count.

These and other fields can be adjusted according to the administrator requirements and the criteria to block/quarantine the users.

Note: Administrators may need to adjust the COUNT value according to the sensitivity of quarantining the users. Accessing a website such as facebook.com may generate multiple logs even though the user has tried to visit the website only once.

2. Configure the automation stitch on the FortiGate. To create an automation stitch, refer to Technical Tip: Creating automation stitches.
   1. Create an automation trigger: Navigate to Security Fabric -> Automation -> Trigger -> Create New.
      
      Select the FortiAnalyzer Event Handler, then select the event handler name which was created on the FortiAnalyzer in the previous step.

2. Create an automation stitch using this automation trigger
   
   Navigate to Security Fabric -> Automation -> Stitch -> Create New.
   • Add the trigger 'Test-webfilter-fgt' created in the previous step.
   • Add an IP Ban action.

Results:

When a user is blocked by the web filter multiple times in 30 minutes, FortiGate bans the IP of that user and quarantines it until the administrator removes the IP from the quarantine.

Check the banned IP in the CLI:

Check the banned IP in the GUI: