Cisco threat-detection shun - How to do it on Forti-OS 6.0.6 100F

[brfrankl]

We are exchanging a Cisco ASA 5010 for a Fortigate 100F and want to configure the same rules/features as the Cisco had.  One thing that we have not been able to find is the equivalent to Cisco threat-detection basic (and shun exceptions)..  Can someone point me in the right direction?   We didn't buy any additional licenses/features so this is just the plain 100F.

Here is the example from the Cisco

threat-detection basic-threat

threat-detection scanning-threat shun except ip-address 10.10.10.0 255.255.255.0 threat-detection scanning-threat shun except ip-address 10.10.10.0 255.255.255.0 threat-detection scanning-threat shun except ip-address 10.10.11.0 255.255.255.0 threat-detection scanning-threat shun except ip-address 172.20.100.0 255.255.255.0 threat-detection scanning-threat shun except ip-address 172.20.105.0 255.255.255.0 threat-detection scanning-threat shun except ip-address 192.168.0.0 255.255.248.0 threat-detection scanning-threat shun except ip-address 192.168.8.0 255.255.248.0 threat-detection scanning-threat shun except ip-address 10.10.12.0 255.255.255.0 threat-detection scanning-threat shun except object-group AV_HOSTS threat-detection scanning-threat shun duration 300 threat-detection statistics threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

TIA

Brian

[justinhatem]

I'm interested in doing this too.  Did you ever find out how? 

For now I'm manually blocking IPs/subnets with a Local-in-policy but that's reactive. 

Create an address group called "BLOCK-ME" or label of your choice, then use SSH or CLI to edit the local-in-policy

edit 5

        set intf "wan1"

        set srcaddr "BLOCK-ME"

        set dstaddr "all"

        set service "ALL"

        set schedule "always"

    next

    edit 6

        set intf "wan2"

        set srcaddr "BLOCK-ME"

        set dstaddr "all"

        set service "ALL"

        set schedule "always"

    next

[brfrankl]

Unfortunately I did not.  For now, we are just doing it manually when we catch someone scanning.  Not a great solution.  Wish someone would reply that knew how to do this more elegantly *hint hint*

[justinhatem]

Some helpful info here too, on the native IPS features:

https://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-security-profiles/IPS/Enable%20IPS%2...

[fernandezm_FTNT]

Good evening.  Not sure if this will help out.  I wrote an article a while back showing how I use the IPS engine of the Fortigate to automatically quarantine an IP address once it triggers a particular severity of signature.  In my case, I changed the filter to be just HIGH and CRITICAL, but you COULD use Low and Informational, although it is not recommended. You can block them up to 1 year.  You can also go in and easily remove the quarantined IPs by going to "Monitor" and "Quarantine Monitor".

Check out the link above.  Hope this helps

[tanr]

The IPS features that @justinhatem lists should give you a good starting point.  You should be able to adjust some of your IPS profiles to include handling specific signatures.  For example, you could add Port.Scanning (ID 43814) as an IPS Signature to change default handling of that signature to quarantine for a set length of time. 

In the same IPS profile you can enable specific rate based signatures (listed at the bottom) and set those to quarantine as well.  For example, MySQL.Login.Brute.Force.  In this case you set a "Block Duration" which should probably just be called quarantine.

Excluding IPs or zones from these IPS signatures would be done by applying the appropriate IPS profiles to security policies for different interfaces, zones, subnets, etc.

Afraid I don't know which specific IPS signatures would match to Cisco's threat detection basic, though.  Maybe somebody else will jump in with that info.