Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kelv1n
New Contributor

Can Fortigate download an IP Dynamic Block List that we define?

Hi

 

We're considering swapping out our Palo Altos for Fortigate, one very useful feature on the Palo Alto's is 

its Dynamic Block List, which can download a text file filled with IPs/CIDR from our server which are then added to the Firewalls block list (blocks are removed each time the list is re-downloaded), this list is generated from a script that correlates all the different IP threat lists, such as DShield, Shadow Server etc.

 

How can we achieve this with Fortigate, i.e. downloading the list adding the IPs to the block list. I've search high and low, but can't see a similar feature.

 

Thanks

1 Solution
Dave_Hall
Honored Contributor

There isn't an import feature for IP addresses on the Fortigate, but some forum posters have come up with scripting solutions that will take a text file list of IP address and convert it into something you can import (copy/paste) into the Fortigate's config (via CLI or text editor).  The linked thread (above) is just one example -- use the search function above this page to search for other scripting solutions.

 

The Fortigates have hard-coded max values for various features, including firewall objects, which is where you define IP addresses.  If we are talking about a list of 1000s of IP addresses, you will want to divide them into groups of 300 or so IP addresses (e.g. IPgroup1, IPgroup2, IPgroup3, etc) -- this is strictly to make the IP addresses manageable when you create the firewall policy to block these addresses.

 

Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

View solution in original post

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
13 REPLIES 13
Dave_Hall
Honored Contributor

There isn't an import feature for IP addresses on the Fortigate, but some forum posters have come up with scripting solutions that will take a text file list of IP address and convert it into something you can import (copy/paste) into the Fortigate's config (via CLI or text editor).  The linked thread (above) is just one example -- use the search function above this page to search for other scripting solutions.

 

The Fortigates have hard-coded max values for various features, including firewall objects, which is where you define IP addresses.  If we are talking about a list of 1000s of IP addresses, you will want to divide them into groups of 300 or so IP addresses (e.g. IPgroup1, IPgroup2, IPgroup3, etc) -- this is strictly to make the IP addresses manageable when you create the firewall policy to block these addresses.

 

Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
kelv1n

Dave Hall wrote:

Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

 

Thanks Dave, thats a good idea. Its more to do with our SIEM solution monitors the different threats lists and then compares that against traffic hitting our Firewalls, so we've integrated those lists into our security management. But our Market is only UK based, so blocking by country is a good alternative.  I might also look into an API option, or scripting it via SSH.

 

fwadm342

Hello,

    Since it's been awhile, I thought I'd follow up...has there been any update to this functionality?  Can you import an external list of IP addresses to block in the firewall, or is it all still manually done?

 

Thanks...

rwpatterson
Valued Contributor III

Check entry #7 in the linked post: https://forum.fortinet.com/tm.aspx?m=156781. ede_phau has written a killer Python script that will do just what you're asking and at the same time, it creates a script which will back out this set of entries that you should run before the next import. Check it out.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
neonbit
Valued Contributor

FYI this feature will be available in FortiOS 6.0. Currently it's in beta but should be released soon(ish).

 

It can be applied to webfilters. Below is the information for this new feature:

 

Web Filtering profiles can make use of multiple external black lists for blocking URLs. These black lists are text files that are in a plain text format, where each line contains a single URL to be blocked.

 

Configure can specify how often, in minutes, these files can be refreshed from the external source.

 

The size of the file can be 10 MB or 128,000 lines of text, which ever is most restrictive.

 

 

fwadm342

Thanks for the information.  I have some questions:

 

[ul]
  • The description mentions URLs - but what about a list of IP addresses?  or CIDRs?  
  • Assuming I have a list of IP addresses, will the hostnames that resolve to that IP address be blocked?  ...or just if the user goes to the specific IP address?
  • What is the frequency that the list can be downloaded?
  • If you submit a URL without a path, will FortiOS block URLs that include the path, or only the exact URL contained in the list?[/ul]

     

    thank you...

  • fernandezm_FTNT

    This is now available in 6.0.

     

    I created a blog post on my personal blog.  

    Manny Fernandez Team Lead Systems Engineering Commercial SE, Miami @secprimate fernandezm@fortinet.com www.infosecmonkey.com
    fwadm342

    I was just reading the documentation (specifically, page 2475 of the FortiOS 6.0 handbook), and it says the limits on an external dynamic block list are either 128K lines, or 10M in size.     My question is - is that total for all external dynamic block lists, or just a single block dynamic list?  And if that's per each dynamic block list, how many external dynamic block lists can you import into your firewall?

     

    thanks...

    emnoc
    Esteemed Contributor III

    Op, don't know but have you  checked out  any max metrics values?

     

    BTW: I wrote a sample  the external resource list on my blog also

     

    http://socpuppet.blogspot.com/2018/04/using-fortios-external-resource-list.html

    We will be using it for URL filtering and a simple caddyServer.

     

    PCNSE 

    NSE 

    StrongSwan  

    PCNSE NSE StrongSwan
    Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors