I want to be able to automatically quaratine ips that will try to use services that are not open from outside, for example telnet or smb.
Now there are no policies to allow such traffic, so they get blocked by policy number 0.
Is it possible to automatically quaratine those that will try for example telnet? And how?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
It doesn't make much sense to quarantine it, if it is already blocked by default. It doesn't make any difference for an automated attack - it will scan the IP/ports and only react if open.
But yes, you can do it with a DoS policy. First need to set the action to block.
A low threshold can be used (under 20) but do not expect a precise count to trigger it, since the counting is not done with regular counters.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.