Hello Team,
I am paloalto more guy and I used to utilize Paloalto's EDLs, so I wanted to ask about any Dynamic group that contains Malicious IP addresses, URLs, or domain lists that are included in the FortiOS and I can use them in my policies.
If not, what are recommeded other sources "feeds" to add as External groups as feed that I can use for more protection in my policies?
or also any Malware Hash feeds that are valuable.
TIA
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello Ramadan
Go to menu Policy & Objects > Internet Service Database, you find all bad IP address DBs under the "IP Reputation DB" section. You can use them in policy depending on their direction, as source, destination or both.
Hello Ramadan
Go to menu Policy & Objects > Internet Service Database, you find all bad IP address DBs under the "IP Reputation DB" section. You can use them in policy depending on their direction, as source, destination or both.
Thank you, Good information and good groups, Do you recommend Blocking them all?
Surre I will keep monitoring in the beggining.
Yes, I deny them all for outgoing traffic and for incoming traffic as well when I publish some server.
For incoming traffic keep it under monitoring just in case of false positive. You know many dynamic client public IP addresses are marked bad.
Very good, I applied the roles for incomming and outgoing traffic and I can see its good and will keep monitoring.
one last question, in paloalto there are almost similar groups, but I need to make sure these groups contents are exist in paloalto, is there a poosible way to reference these fortigate groups on paloalto too, I mean both exchanging their builtin groups?
I don't think so. The data is updated every couple of hours from FortiGuard and it needs a valid support contract on the FortiGate.
I guess it is the same for PAN.
Thank you.
Hi everyone,
Just to supplement this information, it is now possible in FOS v7.4.4+ or v7.6.0+ to use IP Reputation Database Objects as Source Address in the Local-in Policy.
You may refer to this guide :
https://community.fortinet.com/t5/FortiGate/Technical-Tip-IP-Reputation-Database-Objects-as-Source-A...
Thank you
Hello Ramadan,
Please follow the below-attached articles where you can configure the threat feeds and use it in the firewall policy
> https://docs.fortinet.com/document/fortigate/6.2.0/new-features/625349/external-block-list-threat-fe...
> https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/9463/threat-feeds
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1679 | |
1085 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.