Implementing a FortiGate external IP block list with Lupovis

Summary

Dynamic IP blocklists have become an important tool for protecting networks against threats in real time. This guide covers how to integrate them with a FortiGate firewall.

FortiGate lets you use an external block list, also called a threat feed, in firewall policies for web filtering and DNS. The sections below explain how dynamic blocklists work and then set out the practical steps for the integration, whether you are adjusting an existing setup or starting a new one.

Understanding dynamic blocklists

Introduction to dynamic blocklists

Dynamic blocklists, also known as threat feeds or real time blocklists, are continuously updated lists of IP addresses, URLs or domains associated with malicious activities. Static blocklists require manual updates, while dynamic blocklists can import and use an external IP list, which gives a real time response to emerging threats. They strengthen network defences by blocking communications with known harmful entities in advance.

How dynamic blocklists function

Dynamic blocklists operate by collecting data from various threat intelligence sources, then aggregating and analysing it to identify malicious actors. These sources can include cybersecurity research organisations, threat intelligence sharing platforms and other trusted entities that track and report on cyber threats.

When a malicious IP address or domain is identified, the dynamic blocklist is updated. Any attempt to communicate with these known threats is then blocked automatically by the network's firewall or security appliance. This process is ongoing, so the blocklist is always current.

The importance in network security

Implementing dynamic blocklists matters for several reasons:

• Proactive defence: They allow organisations to block threats before they reach the network.
• Resource efficiency: Automating the blocking process saves time and resources that would otherwise be spent on manual threat hunting and updating static blocklists.
• Adaptability: Dynamic blocklists adapt quickly to the changing threat landscape.
• Firewall policies: Dynamic blocklists can be integrated into firewall policies to block connections based on the listed IP addresses.

Examples of threat feeds and blocklist services

The Lupovis blocklist is a global threat intelligence feed providing data on known threats in real time. For example, you can use an IP address threat feed in a local-in policy by creating lists of IP addresses and configuring firewall policies.

You can also integrate the blocklist and use our API with your WAF and SIEM to correlate malicious IPs.

Obtaining the Lupovis dynamic blocklist

Lupovis provides blocklists for a variety of specific security needs. These range from sector and geographical blocklists, compiled to identify zero day adversaries, human actors, bots, mass scanners and other potential threats, to global blocklists.

This is made possible by an extensive network of sensors placed across the internet, which classify and categorise online activity in real time. DNS filter profiles can also be configured to block IP addresses in a threat feed list.

Configuring dynamic blocklists in FortiGate

Accessing the FortiGate web interface

1. Open your browser: Launch your preferred web browser.
2. Enter the FortiGate IP address or hostname: Type the IP address or hostname of your FortiGate device into the address bar, followed by :443 to specify the port (for example https://192.168.1.1:443).
3. Log in: Enter your username and password when prompted to access the FortiGate dashboard.

Setting up Security Fabric

1. Navigate to Security Fabric: In the left hand menu, click "Security Fabric".
2. Configure Security Fabric: Ensure that Security Fabric is enabled and properly configured to include all relevant devices in your network.

Configuring an external connector

1. Go to External Connectors: Within the "Security Fabric" settings, find and select "External Connectors".
2. Add a new connector: Click "IP Addresses" or "Add" to set up a new external connector.
3. Configure the threat feed:
   • Name: Give the connector a descriptive name.
   • Feed URL: Enter the URL of the dynamic blocklist or threat feed.
   • Update interval: Set how frequently FortiGate should collect updates from the threat feed.
4. Test connection: Ensure that FortiGate can successfully retrieve data from the threat feed URL.

Applying the blocklist to security policies

1. Navigate to Firewall Policy: Under "Policy & Objects", select "Firewall Policy".
2. Edit an existing policy or create a new one: Choose a policy to edit, or create a new policy where you want to apply the blocklist.
3. Apply the external connector: In the policy settings, locate the section for source or destination addresses. Add the external connector you have configured to the policy, in our case Lupovis_Blocklist.
4. Configure the rules to match incoming traffic.
5. Right click the policy and select Edit in CLI.
6. Type in: set match-vip enable

The set match-vip command in FortiGate's firewall policy configuration is used to control how the firewall handles traffic in relation to virtual IPs (VIPs) configured on the device.

When you configure a VIP on a FortiGate device, you are setting up a rule to forward traffic from one IP address to another, usually from a public IP address to a private IP address behind the firewall. This is often used for services such as web hosting, where you need to make an internal resource available externally.

Verifying and monitoring

1. Monitor traffic: Use the "Log & Report" section to monitor network traffic and ensure that the dynamic blocklist is actively being enforced.
2. Regularly check that the IP addresses are being updated.

Getting help

Lupovis offers both geographical and sector specific blocklists. Contact Lupovis with any questions about integrating dynamic IP blocklists with FortiGate, or for help with access to our dynamic blocklists.