drop an ip adresse with all protocols

[AEF]

Hi, how to drop a public IP address for all ports tcp and udp packets ? please can you show me all steps. Thank you.

[emnoc]

Easy edit 0 set srcintf " wan1" set dstintf " internal" set srcaddr " 192.0.2.82" set dstaddr " all" set schedule " always" set service " ANY" set action deny <---- make action deny set comments BLOCKED For flooding " next

[rwpatterson]

Also policies are read form the top to the bottom (of each source/destination pair). Make sure this deny is at or near the top of the list.

[emnoc]

good point. Another suggestion, if you have a rash of bad ip_addr to drop, create a address group, and apply that to a fwpolicy. Make it the #1 and just add address to that group. I have a group called blacklist that does exactly just this. config firewall address edit TEST-NET-1 set subnet 192.0.2.0/24 next edit TEST-NET-2 set subnet 198.51.100.0/24 next edit TEST-NET-3 set subnet 203.0.113.0/24 end config firewall addrgrp edit blacklisted set member TEST-NET-1 TEST-NET-2 TEST-NET-3 end than you apply blacklist as the source; set srcintf " wan1" set dstintf " internal" set srcaddr " blacklisted" set dstaddr " all" set schedule " always" set service " ANY" set action deny <---- make action deny set comments " blacklisted address " So now you have the one fwpolicy you move to the top and just append a address to the addressgroup

[ede_pfau]

Usually, there should be no need for an explicit DENY policy as you should not have a ' catch-all' policy allowing WAN hosts into your network. If you use VIPs for access from WAN then this might make sense though. In FOS 5.2, one can negate an address group: you can put the blacklisted addresses into one group and use it negated as source address in your VIP policy. Attack or login attempts targeting the Fortigate itself will NOT be denied by policies! You can either define ' trusted hosts' which are explicitly allowed or disallow administrative access from WAN altogether. The latter is what I recommend.

[AEF]

Hi thank you for your help,