Block public IP after multiple connections

[alinbuletin]

Hi all,

I'm wondering how to ban a public IP connecting too many times to a Fortigate 100D firewall (using v5.2.3,build670). Let's say after 5 connections in a row coming from a public IP. to be able to block this IP for the next x hours.

Is it possible to do it in this box?

Thanks,

Paul

[jtfinley]

Assuming you mean the Admin GUI or SSH.  There is a built in mechanism that bans for about 2 mins.  

Few options

[ul]

Set trusted IP's

Move ports elsewhere

Disable Admin access[/ul]

We wrote a routine that imports email alerts, based on IP, it will spawn an SSH session and blackhole the ip as the example below:

#config router static

#edit 100 (non-conflicting number)

(100) # set blackhole enable

(100) # set dst xxx.xxx.xxx.xxx 255.255.x.x

(100) # end