Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Mirza_Asad2723
New Contributor II

How to Block Source IP when detect port scan for 10 minutes

Dear Concern,

I was saw that someone can try nmap port scanning to findout the open ports or services via WAN side or LAN side and then he attempt the attacks like brute force etc. Can you help me that how can I find the source IP of attacker and how can i configure to block this IP for 10 minutes while he can try port scan automatically. 

 

Thanks and waiting for your helpful appreciable response.

3 REPLIES 3
mpapisetty
Staff
Staff

Hi @Mirza_Asad2723 ,

The DoS Policy takes care of such attacks. Here is an overview of the same - 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/771644/dos-policy

 

-Manoj Papisetty
Mirza_Asad2723

Thanks for your prompt response

I already configured it but when i tried to check nmap port scan via ubuntu so it shows all ports are open so thats why i need to configure that when the attacker attempt nmap port scan so his IP address will be block for defined time like 10 minutes. 

hbac

Hi @Mirza_Asad2723,

 

What is the destination IP of the scan? 

 

Regards, 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors