Is useful block by country?

[condor]

For example: The Fortigate 500D IOS 5.2.3

  Hi, searching in the 500D reports and I repetitive attack from some country, so the quetions: Is useful block by country? For example in first policy :

src: "Netherlands" dst: All

Thanks.

[emnoc · Accepted solution]

Yes but that can kill legit traffic also if for say you had clients from Netherlands. What I would b4 I GEO-IP block;

1: monitor for legit traffic from the region  your planning to block

2: set log on the block policy after you enable block to see what's being blocked

3: monitor and re-monitor

Alternatively you could probably do a IPS rule and a set quarantine or ban action for the SRCs that hit the IPS rule, this is more  friendly and would not strike legit SRCs

[condor]

Hi Emnoc , i'm brand new in IPS , I understand the concept , but where I can create IPS rules? I found only create signatures on FortiGate manuals. Could you please indicate some of documentations about it?

Thanks a lot for your help.