Whitelist Pentester IP Addresses

[mhrth]

Hi,

My company is currently carrying out external pen testing on our servers and it was found out the nmap scan was blocked by FortiGate UTM. Is it possible to whitelist the IP addresses used by the pen testers? If possible, where should I whitelist those ip addresses?

Thank you.

[Anonymous]

Hello @mhrth ,

Thank you for posting to the Fortinet Community Forum.

Can you confirm if you have a policy in place that is blocking this traffic?

Can you try to run a sniffer and see if the traffic is reaching FortiGate?

Go on CLI and enter the command to run sniffer.

>di sniffer packet any 'host <Public_IP_address_of_tester>' 4 0 l 

If you run the test and see the output on the above debug, which means that the traffic is reaching the FortiGate.

Thereafter run a packet capture to confirm where the traffic is getting blocked.

>di de flow filter addr <Public_IP_address_of_tester>
>di de flow trace start 9999

>di de en

Run the test again and gather the output.

Please share the output for the above and I can guide you to the next step.

If you have found the solution, then please share it with the Fortinet Community users.

You can also use the link for your reference:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...

Let us know if this helps.

Thanks

[echo · Accepted solution]

I suggest to create a firewall policy above the others that allows traffic, where the source is pentesters IP or network and for the destination you group all the (tested) portforwards, either one by one or as members of a single group of portforwards (virtual IP's) -- the latter can be used for other purposes too and can be updated more conveniently in the future if a new portforward is added. Another way is to use "Exempt IP" feature inside the IPS profile but that will only work for the IPS then and not for other possibly used security profiles in portforwards' firewall rules.

[AEK]

Check your FortiGate's IPv4 DoS Policy