Fortinet FortiGate

Add the list as an external threat feed and deny it in firewall and local-in policies.

FortiGate can import a list of addresses from a URL as an external threat feed (a Security Fabric connector) and use it as a source in firewall policies. Point a feed at the plain-text blocklist.

Set it up

Go to Security Fabric › External Connectors, click Create New and choose IP Address under Threat Feeds.
Set Name to isipsafe, URI of external resource to:
```
https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=txt&confidenceMinimum=90&limit=100000
```
and Refresh rate to 60 minutes. Leave HTTP basic authentication off; the key is in the URL. Click OK, then View Entries to check it loaded.
Go to Policy & Objects › Firewall Policy and add a policy at the top: Incoming your WAN interface, Source isipsafe, Destination all, Service ALL, Action DENY. Repeat for each WAN interface.

Protect the FortiGate itself

Firewall policies do not cover traffic to the FortiGate's own services (SSL VPN, admin login). Add a local-in policy from the CLI:

config firewall local-in-policy
    edit 0
        set intf "wan1"
        set srcaddr "isipsafe"
        set dstaddr "all"
        set service "ALL"
        set schedule "always"
        set action deny
    next
end

Brute force against SSL VPN is one of the most common FortiGate attacks; most of the addresses doing it are already on the list.

Need a hand?

If something here does not work with your version of Fortinet FortiGate, or you have improved it, tell us. We update these pages with what people send.

Fortinet FortiGate and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.