Fortigate - Some security questions

[damianhlozano]

Hello team!!!

Happy new year to everyone using gregorian calendar!!

I have the following 3 questions about Fortigate:

1) To block phishing I am using web filter, is there another Fortigate feature to add, to help blocking phishing attempts?

2) Is there any place in the Fortigate where I can see security alerts for applications installed on computers?  I dont think so, but I'm asking just in case

3) You know another feature to block suspicious network activities in addition to DOS rules and IPS profiles?

This is for all the traffic comming through the Fortigate, not for traffic between 2 computers in the same LAN, of course.

Thanks in advance.

Regards,

Damián

[dingjerry_FTNT]

Hi @damianhlozano ,

1) Yes.

2) Not Sure what security alerts you are talking about.  The certificate warning message?

3) Application Control

[damianhlozano]

Hello, thanks for your response!

No, I was no talking about certificate warning message

[AEK · Accepted solution]

Hi Damian

1. You can create a policy to deny traffic going to ISDB "IP Reputation Database"
2. FortiGate can't know what is installed on your computer, but can guess (by traffic signature) which application is sending the traffic from the comuter. You can use application control profile for that, as suggested by Jerry above
3. DoS, IPS, Web filter, DNS filter, certificate inspection, email filter, AV, ..., all of these can be used to block suspicious traffic

You are right, FGT can't see traffic inside the same VLAN, unless you use micro-segmentation, like the one provided by FortiSwitch when managed by FortiGate.

[damianhlozano]

Thank you AEK!!

I didnt know about ISDB "IP Reputation Database", I will search for this, this seems very useful

All your response is useful!

[kaman]

Hi damianhlozano,

To enhance phishing prevention in Fortigate, in addition to using the Web Filter feature, you can also utilize the Antiphishing feature. The Antiphishing feature scans user names and passwords in submission traffic against sensitive corporate network credentials stored in the corporate domain controller.

By configuring antiphishing rules in proxy mode web filter profiles, Fortigate can block URLs or alert users when phishing attempts are detected. This feature provides an additional layer of protection against phishing attacks by specifically targeting credential phishing attempts.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-AI-driven-credential-phishing-prevention/t...

Regards,
Aman

[damianhlozano]

Thank you Kaman!!!

I will read about this