automatic intrusion ip block

[MegaSistemas]

Hello guys

I noticed that a certain ip tried to invade a web server and IPS dropped that attempt, but soon after that same ip tried several more times. Is there a way to configure FGT to automatically block this ip for minutes or hours, so you can not keep trying every second? or that it is inserted into a blacklist?

[darwin_FTNT · Accepted solution]

See the following and enable IPS utm profile quarantine feature:

https://forum.fortinet.com/tm.aspx?m=151871

Quarantine list is maintained by kernel and is more efficient in cpu usage in terms of blocking quarantined client connections.

[darwin_FTNT · Accepted solution]

See the following and enable IPS utm profile quarantine feature:

https://forum.fortinet.com/tm.aspx?m=151871

Quarantine list is maintained by kernel and is more efficient in cpu usage in terms of blocking quarantined client connections.

[Bruno_Pereira · Accepted solution]

Hello,

it's possibilite with quarantine, you can set the time.You can then check the blocked IPs on monitor> quarantine monitor.