- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fortinet recommended malicious IPs or URLs, or Malware Hash source
Hello Team,
I am paloalto more guy and I used to utilize Paloalto's EDLs, so I wanted to ask about any Dynamic group that contains Malicious IP addresses, URLs, or domain lists that are included in the FortiOS and I can use them in my policies.
If not, what are recommeded other sources "feeds" to add as External groups as feed that I can use for more protection in my policies?
or also any Malware Hash feeds that are valuable.
TIA
Solved! Go to Solution.
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Ramadan
Go to menu Policy & Objects > Internet Service Database, you find all bad IP address DBs under the "IP Reputation DB" section. You can use them in policy depending on their direction, as source, destination or both.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Ramadan
Go to menu Policy & Objects > Internet Service Database, you find all bad IP address DBs under the "IP Reputation DB" section. You can use them in policy depending on their direction, as source, destination or both.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, Good information and good groups, Do you recommend Blocking them all?
Surre I will keep monitoring in the beggining.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I deny them all for outgoing traffic and for incoming traffic as well when I publish some server.
For incoming traffic keep it under monitoring just in case of false positive. You know many dynamic client public IP addresses are marked bad.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Very good, I applied the roles for incomming and outgoing traffic and I can see its good and will keep monitoring.
one last question, in paloalto there are almost similar groups, but I need to make sure these groups contents are exist in paloalto, is there a poosible way to reference these fortigate groups on paloalto too, I mean both exchanging their builtin groups?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't think so. The data is updated every couple of hours from FortiGuard and it needs a valid support contract on the FortiGate.
I guess it is the same for PAN.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi everyone,
Just to supplement this information, it is now possible in FOS v7.4.4+ or v7.6.0+ to use IP Reputation Database Objects as Source Address in the Local-in Policy.
You may refer to this guide :
https://community.fortinet.com/t5/FortiGate/Technical-Tip-IP-Reputation-Database-Objects-as-Source-A...
Pau
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Ramadan,
Please follow the below-attached articles where you can configure the threat feeds and use it in the firewall policy
> https://docs.fortinet.com/document/fortigate/6.2.0/new-features/625349/external-block-list-threat-fe...
> https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/9463/threat-feeds