Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Automatic blocking IP to prevent Fortigate web interface login page



Last few days I started to see new activity on my WAN link - many login attempts on HTTPS interfaces of my Fortigates. In majority they come from IP: but not exclusevily. My question is how to automatically block these attempts, i.e. to ban certain IP from viewing login page of Forti after few unsuccessfull login trials.


I have few Fortigates with soft not older than 6.2.15.



New Contributor III


Hi pszewczyk


Apply the given command to the CLI Script of the action field.

diagnose user banned-ip add src4 %%srcip%% 0 admin


If that doesn't resolve then create a group and append it to the local-in policy. 

To Create and append addresses to the group, you can find the attached link.


Hope that helps, 


Kind Regards, 

Bijay Prakash Ghising



Hi pszewczyk,


Based on my understanding you want to block any specific IP to your FortiGate interface. You can create a local-in policy to block specific IPs reaching your FortiGate interface. You may refer to the KB below for more information:-


Best Regards,


New Contributor II

To automatically block IP addresses and prevent unauthorized access to the Fortigate web interface login page, you can implement a security policy using the built-in features of the Fortigate. Here's a concise solution:

Log in to your Fortigate web interface.
Go to "Security Profiles" and create a new "DoS Policy".
Set "DoS Policy Type" to "HTTP Login Protection".
Configure "HTTP Login Protection Settings" to specify the number of allowed login attempts and the duration of the block.
Apply the policy to your WAN-facing interface.

For more detailed instructions and further assistance, visit Fortinet's official website at training


I hope this will help you.

Emma Wilson



Firstly, its not a best security practice to allow HTTPS/SSH on the WAN interface of FortiGate. So I would recommend you to disable HTTPS/HTTP/SSH and other Services on the WAN Interface. 


Even after disabling the service on the WAN interface and you still see some traffic reaching your WAN and effecting the system performance, you may apply other recommendations mentioned here.


Best Regards,