Blocking of known malicious IP is not working.

[martyyy]

I am trying to block known malicious IP and created appropriate address group, added the IPs then created a rule to deny traffic coming from this group. I have seen an IP that came in which means that the new access rule which is on top of the list isnt working.

Here is the link I follow but it doesn't work.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-specific-external-public-IP-a...

Is there also any source of known malicious IP from somewhere and feed it to my firewall. That way I don't have to manually update each time.

TIA :) 

[mpapisetty]

@martyyy ,

Could you share a snippet of the policy that is configured? If a deny rule is on top of the policy list, it would always block the traffic that matches. 

You could also try reputation based filter in the policy - 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/68937/ip-reputation-filterin...

[Toshi_Esumi]

If the malicious attacks are against the interface IP on the FGT itself, you need to use local-in-policy to block the attacks at the incoming interface. Regular [outside port -> inside port] policies wouldn't apply to the type of traffic.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Use-local-in-policy-to-restrict-unauthoriz...

Toshi