Hot!Cisco threat-detection shun - How to do it on Forti-OS 6.0.6 100F

Author
brfrankl
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/08/14 09:27:56
  • Status: offline
2019/08/14 09:37:35 (permalink)
0

Cisco threat-detection shun - How to do it on Forti-OS 6.0.6 100F

We are exchanging a Cisco ASA 5010 for a Fortigate 100F and want to configure the same rules/features as the Cisco had.  One thing that we have not been able to find is the equivalent to Cisco threat-detection basic (and shun exceptions)..  Can someone point me in the right direction?   We didn't buy any additional licenses/features so this is just the plain 100F.
 
Here is the example from the Cisco
 
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address 10.10.10.0 255.255.255.0
threat-detection scanning-threat shun except ip-address 10.10.10.0 255.255.255.0
threat-detection scanning-threat shun except ip-address 10.10.11.0 255.255.255.0
threat-detection scanning-threat shun except ip-address 172.20.100.0 255.255.255.0
threat-detection scanning-threat shun except ip-address 172.20.105.0 255.255.255.0
threat-detection scanning-threat shun except ip-address 192.168.0.0 255.255.248.0
threat-detection scanning-threat shun except ip-address 192.168.8.0 255.255.248.0
threat-detection scanning-threat shun except ip-address 10.10.12.0 255.255.255.0
threat-detection scanning-threat shun except object-group AV_HOSTS
threat-detection scanning-threat shun duration 300
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
 
TIA
Brian
#1

5 Replies Related Threads

    justinhatem
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/31 06:59:53
    • Status: offline
    Re: Cisco threat-detection shun - How to do it on Forti-OS 6.0.6 100F 2019/11/01 05:44:13 (permalink)
    0
    I'm interested in doing this too.  Did you ever find out how? 
     
    For now I'm manually blocking IPs/subnets with a Local-in-policy but that's reactive. 
    Create an address group called "BLOCK-ME" or label of your choice, then use SSH or CLI to edit the local-in-policy
     
    edit 5
            set intf "wan1"
            set srcaddr "BLOCK-ME"
            set dstaddr "all"
            set service "ALL"
            set schedule "always"
        next
        edit 6
            set intf "wan2"
            set srcaddr "BLOCK-ME"
            set dstaddr "all"
            set service "ALL"
            set schedule "always"
        next
     
    #2
    brfrankl
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/08/14 09:27:56
    • Status: offline
    Re: Cisco threat-detection shun - How to do it on Forti-OS 6.0.6 100F 2019/11/01 07:03:37 (permalink)
    0
    Unfortunately I did not.  For now, we are just doing it manually when we catch someone scanning.  Not a great solution.  Wish someone would reply that knew how to do this more elegantly *hint hint*
     

    #3
    justinhatem
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/31 06:59:53
    • Status: offline
    Re: Cisco threat-detection shun - How to do it on Forti-OS 6.0.6 100F 2019/11/01 09:47:26 (permalink)
    #4
    fernandezm_FTNT
    New Member
    • Total Posts : 8
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/04/14 02:46:59
    • Status: offline
    Re: Cisco threat-detection shun - How to do it on Forti-OS 6.0.6 100F 2019/11/01 18:57:59 (permalink)
    0
    Good evening.  Not sure if this will help out.  I wrote an article a while back showing how I use the IPS engine of the Fortigate to automatically quarantine an IP address once it triggers a particular severity of signature.  In my case, I changed the filter to be just HIGH and CRITICAL, but you COULD use Low and Informational, although it is not recommended. You can block them up to 1 year.  You can also go in and easily remove the quarantined IPs by going to "Monitor" and "Quarantine Monitor".
     
    Check out the link above.  Hope this helps
     
     
    #5
    tanr
    Platinum Member
    • Total Posts : 718
    • Scores: 33
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: Cisco threat-detection shun - How to do it on Forti-OS 6.0.6 100F 2019/11/02 15:30:40 (permalink)
    0
    The IPS features that @justinhatem lists should give you a good starting point.  You should be able to adjust some of your IPS profiles to include handling specific signatures.  For example, you could add Port.Scanning (ID 43814) as an IPS Signature to change default handling of that signature to quarantine for a set length of time. 
     
    In the same IPS profile you can enable specific rate based signatures (listed at the bottom) and set those to quarantine as well.  For example, MySQL.Login.Brute.Force.  In this case you set a "Block Duration" which should probably just be called quarantine.
     
    Excluding IPs or zones from these IPS signatures would be done by applying the appropriate IPS profiles to security policies for different interfaces, zones, subnets, etc.
     
    Afraid I don't know which specific IPS signatures would match to Cisco's threat detection basic, though.  Maybe somebody else will jump in with that info.
    #6
    Jump to:
    © 2020 APG vNext Commercial Version 5.5