Fortigate sandboxing

sonydarrel · ‎09-25-2019

Dear experts

i have a fortigate firewall and also a Cisco Firewall (FTD) and i m planning for fortinet Sandboxing solution will Cisco FTD firewall will work with Fortinet Sandboxing, please confirm.

thanks

ede_pfau · ‎09-25-2019

Depends on your usage of "work".

The main advantage of the FSA is that it will create a custom signature update immediately and distribute it in your network, to other FortiGates, FortiMails or FortiClients. Other vendors will not benefit from this.

As the FSA is not in-line with the analyzed data stream (for instance, the FGT is), it cannot block malicious traffic directly. It will generate signatures so that the other devices mentioned above will be able to recognize and block the malware.

Ede

"Kernel panic: Aiee, killing interrupt handler!"

View solution in original post

ede_pfau · ‎09-25-2019

Depends on your usage of "work".

The main advantage of the FSA is that it will create a custom signature update immediately and distribute it in your network, to other FortiGates, FortiMails or FortiClients. Other vendors will not benefit from this.

As the FSA is not in-line with the analyzed data stream (for instance, the FGT is), it cannot block malicious traffic directly. It will generate signatures so that the other devices mentioned above will be able to recognize and block the malware.

Ede

"Kernel panic: Aiee, killing interrupt handler!"

KPS · ‎09-25-2019

Hi!

Fortisandbox seems to be a bit "open" to the world, as it can create IOC-packages.

https://docs.fortinet.com/document/fortisandbox/3.0.3/administration-guide/170699/ioc-package

I am not 100% sure, but you should ask your Cisco Rep, if and how these hashes, etc. could be imported to your devices.

KPS

sonydarrel · ‎09-26-2019

Dear Experts

Cisco Confirmed it will not work