Ban ip in ips

[rezafathi]

Hello

I have ips enabled for protecting our web servers and sometimes I see attacks . So how can i automatically block attacker ip when they attack?

[ozkanaltas]

Hello @rezafathi ,

You can use quarantine action in the IPS profile. Also, you can determine quarantine time in this action. 

If you want to get more information about configuring IPS profile, you can review this document.

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/583477/configuring-an-ips-se...

[KumarV]

Hello, @rezafathi 

You can use the KB mentioned below. You will be able to create a automation stitch which would automatically add the rouge IP's in a group and then you can use that group in a firewall policy to block the access.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Permanently-block-rogue-IPs-from-accessing...

Regards

Verender

[LunarEcho]

Setting up automatic IP blocking can definitely help ease the burden. One option is using tools like fail2ban or ModSecurity with custom rules to detect and block suspicious activity.