Can Fortigate download an IP Dynamic Block List that we define?

[kelv1n]

Hi

We're considering swapping out our Palo Altos for Fortigate, one very useful feature on the Palo Alto's is 

its Dynamic Block List, which can download a text file filled with IPs/CIDR from our server which are then added to the Firewalls block list (blocks are removed each time the list is re-downloaded), this list is generated from a script that correlates all the different IP threat lists, such as DShield, Shadow Server etc.

How can we achieve this with Fortigate, i.e. downloading the list adding the IPs to the block list. I've search high and low, but can't see a similar feature.

Thanks

[Dave_Hall · Accepted solution]

There isn't an import feature for IP addresses on the Fortigate, but some forum posters have come up with scripting solutions that will take a text file list of IP address and convert it into something you can import (copy/paste) into the Fortigate's config (via CLI or text editor).  The linked thread (above) is just one example -- use the search function above this page to search for other scripting solutions.

The Fortigates have hard-coded max values for various features, including firewall objects, which is where you define IP addresses.  If we are talking about a list of 1000s of IP addresses, you will want to divide them into groups of 300 or so IP addresses (e.g. IPgroup1, IPgroup2, IPgroup3, etc) -- this is strictly to make the IP addresses manageable when you create the firewall policy to block these addresses.

Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

[kelv1n]

Dave Hall wrote:

Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

Thanks Dave, thats a good idea. Its more to do with our SIEM solution monitors the different threats lists and then compares that against traffic hitting our Firewalls, so we've integrated those lists into our security management. But our Market is only UK based, so blocking by country is a good alternative.  I might also look into an API option, or scripting it via SSH.

[fwadm342]

Hello,

    Since it's been awhile, I thought I'd follow up...has there been any update to this functionality?  Can you import an external list of IP addresses to block in the firewall, or is it all still manually done?

Thanks...

[rwpatterson]

Check entry #7 in the linked post: https://forum.fortinet.com/tm.aspx?m=156781. ede_phau has written a killer Python script that will do just what you're asking and at the same time, it creates a script which will back out this set of entries that you should run before the next import. Check it out.

[neonbit]

FYI this feature will be available in FortiOS 6.0. Currently it's in beta but should be released soon(ish).

It can be applied to webfilters. Below is the information for this new feature:

Web Filtering profiles can make use of multiple external black lists for blocking URLs. These black lists are text files that are in a plain text format, where each line contains a single URL to be blocked.

Configure can specify how often, in minutes, these files can be refreshed from the external source.

The size of the file can be 10 MB or 128,000 lines of text, which ever is most restrictive.

[fwadm342]

Thanks for the information.  I have some questions:

[ul]

The description mentions URLs - but what about a list of IP addresses?  or CIDRs?  

Assuming I have a list of IP addresses, will the hostnames that resolve to that IP address be blocked?  ...or just if the user goes to the specific IP address?

What is the frequency that the list can be downloaded?

If you submit a URL without a path, will FortiOS block URLs that include the path, or only the exact URL contained in the list?[/ul]

thank you...

[fernandezm_FTNT]

This is now available in 6.0.

I created a blog post on my personal blog.  

[fwadm342]

I was just reading the documentation (specifically, page 2475 of the FortiOS 6.0 handbook), and it says the limits on an external dynamic block list are either 128K lines, or 10M in size.     My question is - is that total for all external dynamic block lists, or just a single block dynamic list?  And if that's per each dynamic block list, how many external dynamic block lists can you import into your firewall?

thanks...

[emnoc]

Op, don't know but have you  checked out  any max metrics values?

BTW: I wrote a sample  the external resource list on my blog also

http://socpuppet.blogspot.com/2018/04/using-fortios-external-resource-list.html

We will be using it for URL filtering and a simple caddyServer.