Can we roll out 5000 null routes at a moment?

[blason]

Hi Guys,

I need to know if we can roll out or script bulk routing. That is I need to add certain malicious IPs may be 5000/6000 in numbers and need to add null route for those to block.

[ede_pfau]

hi,

that depends on your hardware and the version of FortiOS used.

For example, http://help.fortinet.com/fgt/54/max-values/5-4-6/max-values.html shows the hardcoded limits for "static routes" as 500 for a 100D, 10.000 for a 600D. Same limits apply for FOS v5.6.3 (but this is not always the case).

You can check the currently implemented value on your hardware as well.

Type "print tablesize" in the CLI, and look for the line containing "router.static". 'grep' unfortunately doesn't work in this context.

Using (and maintaining!) 5.000 blackhole routes is cumbersome to say the least. Why not trust FortiGuard botnet and malicious sites' IP lists which are updated continuously?

[emnoc]

Agreed, managing   BH-routes or address group is not  effective.

Ken