Email gateway under attack

[itservices2]

Have a fortigate 60D which pushes only smtp /https traffic to our email gateway. However seeing quite a lot of authentication failures on our barracuda the email firewall. IPS and AV is enabled for the UTM . Any way to check this out. Cant do block by ip isnce it is random ip on a daily basis. Running firmware 5.0.10

[rwpatterson]

Can you spot a trend in the IP addresses by location (global location)? The Fortigates in newer versions support policies by region.

[emnoc · Accepted solution]

if it's pure auth failures you can write a custom signature

http://socpuppet.blogspot.com/2014/07/example-fo-smpauth-protection-fortigate.html

[seadave]

You might be able to use a DoS policy to drop by source or what I do is have all of my IPS rules setup to ban source IPs for 30 days once triggered.  Stops a lot of these guys in there tracks.  Make sure you aren't NAT'ing inbound by mistake.  I did this once a long time ago and it caused all sorts of problems.