Block inside attacks

[rezafathi]

Hello

How can i block inside attacks like portscan or other attacks with fortigate inside my Lan?

[ebilcari]

There are two possible ways as shown also in this article:

- application control with custom signatures

- configuring a DoS policy

More general information can also be found here.

[rezafathi]

Thanks. How can i find each application signature and use it in app control?

[Sheikh]

Hello @rezafathi 

This would also help in application detection and control.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-check-Application-Control-category-...

regards,

Sheikh

[AEK]

Hi Reza

Try to configure a new IPS profile that blocks the below signature (Port.Scanning), then use it in your firewall policy.

Note that the default action for this signature is "Allow", that's why it is not blocked in the default IPS profiles.

[rezafathi]

I can not find this signature

[AEK]

Make sure your IPS signatures are updated.

diagnose autoupdate versions