Fortinet recommended malicious IPs or URLs, or Malware Hash source

[MORAMADAN]

Hello Team,

                 I am paloalto more guy and I used to utilize Paloalto's EDLs, so I wanted to ask about any Dynamic group that contains Malicious IP addresses, URLs, or domain lists that are included in the FortiOS and I can use them in my policies.

If not, what are recommeded other sources "feeds" to add as External groups as feed that I can use for more protection in my policies?

or also any  Malware Hash feeds that are valuable.

TIA                  

[AEK · Accepted solution]

Hello Ramadan

Go to menu Policy & Objects > Internet Service Database, you find all bad IP address DBs under the "IP Reputation DB" section. You can use them in policy depending on their direction, as source, destination or both.

[MORAMADAN]

Thank you, Good information and good groups, Do you recommend Blocking them all?

Surre I will keep monitoring in the beggining.

[AEK]

Yes, I deny them all for outgoing traffic and for incoming traffic as well when I publish some server.

For incoming traffic keep it under monitoring just in case of false positive. You know many dynamic client public IP addresses are marked bad.

[MORAMADAN]

Very good, I applied the roles for incomming and outgoing traffic and I can see its good and will keep monitoring.

one last question, in paloalto there are almost similar groups, but I need to make sure these groups contents are exist in paloalto, is there a poosible way to reference these fortigate groups on paloalto too, I mean both exchanging their builtin groups?

[AEK]

I don't think so. The data is updated every couple of hours from FortiGuard and it needs a valid support contract on the FortiGate.

I guess it is the same for PAN.

[MORAMADAN]

Thank you.

[pdelapena]

Hi everyone,

Just to supplement this information, it is now possible in FOS v7.4.4+ or v7.6.0+ to use IP Reputation Database Objects as Source Address in the Local-in Policy.

You may refer to this guide : 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-IP-Reputation-Database-Objects-as-Source-A...

[MORAMADAN]

Thank you

[lkumar]

Hello Ramadan,

Please follow the below-attached articles where you can configure the threat feeds and use it in the firewall policy

> https://docs.fortinet.com/document/fortigate/6.2.0/new-features/625349/external-block-list-threat-fe...
> https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/9463/threat-feeds