Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
scheuri
New Contributor III

External BotNet Lists in AMP Profil or IPS Sensor?

Hello all

 

Is it possible to add (external/thirdparty) lists of BotNet IP addresses in the AMP/AV profile or the IPS sensor?

 

As far as I can see it is possible to add thirdparty/external AV-Lists, however, I am not sure if AMP/AV does check IP addresses or if those thirdparty/external AV-Lists need to be AV signatures.

As far as I can see there is no option in the IPS profile/sensor to add external lists.

 

So my best guess at the moment is, that it this is no possible - did someone do this by any chance and can confirm that it indeed might be possible?

 

Thanks a lot, much appreciated

1 Solution
AlexC-FTNT
Staff
Staff

Starting with FortiOS 6.2, you can add an external list of IPs or domains that you want to block:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-External-threat-list-threat-feed-blocked-v...

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/9463/threat-feeds

Is this what you are looking for?


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -

View solution in original post

2 REPLIES 2
AlexC-FTNT
Staff
Staff

Starting with FortiOS 6.2, you can add an external list of IPs or domains that you want to block:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-External-threat-list-threat-feed-blocked-v...

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/9463/threat-feeds

Is this what you are looking for?


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
scheuri
New Contributor III

Thank you AlexC for both links.

 

I was indeed not aware that one can use external lists in the firewall policy itself as source or destination.
The second link I already was aware of and if I am reading that article correctly, then an external threat feed containing IP addresses can be used in the DNS filter (security profile), but none other (such as AV, IPS, etc.).

 

Thank you for the first linke and for confirming my assumption.
Much appreciated