Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

FortiOS 5.4 Internet Service Database Usage

While the new Internet Service Database in 5.4 is a useful reference indeed, it is frustrating that entries in it cannot be bound to firewall policies (at least not that I've found).  You have service entries in there with thousands of IP address / port combinations that would be very useful to reference in policies, whereas you would normally be required to define all of those addresses as individual address objects in the configuration.


Are there any plans to allow us to use this new feature in policies? Or am I just missing the way to do it currently?

1 Solution



Yes if you have a valid Fortiguard subscription. However, quality can be variable depending on the service.


Office 365, Microsoft publish all the changes in an RSS feed at least 30 days ahead of changes so quality is excellent. 


On the other end of the spectrum, Netflix doesn't communicate and update are very reactive. Not a problem if you ban Netflix as the service won't be using only the additional IP and will be efficiently blocked but if you want to use it to allow and assign particular profile such as no SSL interception (as Netflix very sensitive to SSL) it's a big issue (and they keep using additional FQDN too so wildcard FQDN for exception as an alternative/top up need maintenance too).





mahesh p mohan wrote:



i have used the policy in 5.6 in one of our customer fortigate 100E and found traffic in policy. they have issue when accessing AWS service with UTM profile.


but i have a question . fortigate internet service database will update automatically? or not ?

if a new ip use by AWS that will update in the database?





View solution in original post

New Contributor

I have to agree to that. The Internet Service Database in its current form is somewhat pointless. There is apparently (almost) nothing which can be done with the entries displayed. Currently they can only be used for static routes.


In example it would be convenient to have a Fortinet provided database of all Amazon networks - but only the networks as I want to specify the ports by my own.

Contributor II

I was wondering what we can do with this internet service database, as well


Up to now I found that this DB is used to resolve the unknown applications (WebUI: Log&Report > Log Settings > Resolve Unknown Applications) - try the mouse-over event with the info "i".


Additionally it seems that you can add those services to the static routes... (CLI only)

config router static

  edit <n>

    set internet-service           # Application ID in the Internet service database. end

Unfortunately those routes don't changes anything...


Maybe you have more luck in configuring this...





So I've been playing around with this feature and discovered in the CLI you can create your own Custom Entries.


config application internet-service-custom


Then go from there and design your own entries. Just thought I would pass this on. I also agree, they need to allow you to use it in Firewall Policies, if so, that would be a very powerful feature.


I sure hope 5.4.1 utilizes this.  I opened this one afternoon and thought great, I can add this to this policy.. was frustrating to see that after 2 hours thinking I'm missing the obvious... that is its not possible.  This would certainly be a powerful feature.



Indeed, I'd expect them to use in firewall policies. This doesn't seem possible even in 5.4.1 :(


When it will be added to firewall policy?



New Contributor

Hi guys,

any news?

Contributor III



you can use the Internet Service Database in the firewall policy in FortiOS 5.6 Beta.




NSE 4/5/7

NSE 4/5/7

So this, plus standards compliant syslog output? Wow 4.6 is looking big :)


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors