Can Fortigate download an IP Dynamic Block List that we define?

kelv1n · ‎12-31-2014

Hi

We're considering swapping out our Palo Altos for Fortigate, one very useful feature on the Palo Alto's is

its Dynamic Block List, which can download a text file filled with IPs/CIDR from our server which are then added to the Firewalls block list (blocks are removed each time the list is re-downloaded), this list is generated from a script that correlates all the different IP threat lists, such as DShield, Shadow Server etc.

How can we achieve this with Fortigate, i.e. downloading the list adding the IPs to the block list. I've search high and low, but can't see a similar feature.

Thanks

Dave_Hall · ‎12-31-2014

There isn't an import feature for IP addresses on the Fortigate, but some forum posters have come up with scripting solutions that will take a text file list of IP address and convert it into something you can import (copy/paste) into the Fortigate's config (via CLI or text editor). The linked thread (above) is just one example -- use the search function above this page to search for other scripting solutions.

The Fortigates have hard-coded max values for various features, including firewall objects, which is where you define IP addresses. If we are talking about a list of 1000s of IP addresses, you will want to divide them into groups of 300 or so IP addresses (e.g. IPgroup1, IPgroup2, IPgroup3, etc) -- this is strictly to make the IP addresses manageable when you create the firewall policy to block these addresses.

Edit: If a majority of these IP address are from foreign countries, the Fortigate is capable of blocking IP addresses by country origin.

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

View solution in original post

fwadm342 · ‎05-01-2018

Hi there...thanks for the reply.

Hmm...max metric values? where would I look for those?

Thanks for the blog post...that's helpful.

emnoc · ‎05-01-2018

http://help.fortinet.com/fgt/handbook/52/5-2-2/max-values.html

try print tablesize from the cli

Ken

PCNSE

NSE

StrongSwan

zarn · ‎06-05-2018

@dave

How exactly does fortinet update the Geography type definition? I would assume there are changes over time.

emnoc · ‎06-06-2018

I wrote something about this on my blog

http://socpuppet.blogspot.com/2017/08/fortios-geoip-tips.html

PCNSE

NSE

StrongSwan