How to Block Source IP when detect port scan for 10 minutes

[Mirza_Asad2723]

Dear Concern,

I was saw that someone can try nmap port scanning to findout the open ports or services via WAN side or LAN side and then he attempt the attacks like brute force etc. Can you help me that how can I find the source IP of attacker and how can i configure to block this IP for 10 minutes while he can try port scan automatically. 

Thanks and waiting for your helpful appreciable response.

[mpapisetty]

Hi @Mirza_Asad2723 ,

The DoS Policy takes care of such attacks. Here is an overview of the same - 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/771644/dos-policy

[Mirza_Asad2723]

Thanks for your prompt response

I already configured it but when i tried to check nmap port scan via ubuntu so it shows all ports are open so thats why i need to configure that when the attacker attempt nmap port scan so his IP address will be block for defined time like 10 minutes. 

[hbac]

Hi @Mirza_Asad2723,

What is the destination IP of the scan? 

Regards,