External IP Block List Not Working

[dthorpe]

I’m trying to create a policy to block IPs from the EmergingThreats list using an External Connector feed, but it doesn’t seem to be working as expected.

I have an External Connector > IP Address External Feed configured, and it shows approximately 1500 valid entries.

Connection Status 2025/10/28 08:31:32

Last Content Update 2025/10/27 16:31:24

Entries 1490  Valid  

I can view the entries, and if I manually test one of the IPs by browsing to it, the connection succeeds, it’s not being blocked. 

If I add a single IP address directly to this rule, it does block that address correctly. However, when I rely on the external feed, it does not block any of the listed IPs. I’ve also tested with other external IP lists, and I’m seeing the same issue.

Is there something wrong with my configuration, or should I be implementing IP blocking in a different way?

Here’s the policy configuration I’m using:

config system external-resource
edit "Emergingthreats-block-IPs.net"
set uuid 05a9ff8e-cf98-51ef-828e-33680b9d9101
set type address
set resource "https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt"
set refresh-rate 60
next
end

config firewall security-policy
edit 215
set uuid 11ed86ec-8dc7-51f0-d96b-b317e5087810
set name "DT Testing Emergingthreats Block"
set srcintf "any"
set dstintf "any"
set srcaddr "grp dthorpe devices"
set dstaddr "Emergingthreats-block-IPs.net"
set enforce-default-app-port disable
set service "ALL"
set schedule "always"
set logtraffic all
next
end

FW1 # diagnose sys external-address-resource list
List of external address resources:
name:Emergingthreats-block-IPs.net, uuid-idx:3446, num of ipv4/ipv6 ranges:1290/0, used:yes

...

FW1 # diagnose sys external-address-resource list Emergingthreats-block-IPs.net
IPv4 ranges of uuid-idx 3446 (num=1290)
1.10.16.0-1.10.31.255
1.19.0.0-1.19.255.255
1.32.128.0-1.32.191.255
...

We are running 

Model FortiGate 901G 

Version v7.6.x

[AEK]

Can you try add this to the policy and see if it helps?

set auto-asic-offload disable