FortiGate

Requires the feed to be enabled. The FortiGate imports the feed as an IP address threat feed (intrudect-block). Deny policies use it as source and destination.

Threat feed

GUI: Security Fabric > External Connectors > Create New > Threat Feeds > IP Address.

Field	Value
Name	intrudect-block
Update method	External Feed
URI of external resource	feed address from Site > Firewall integration > Feed
Refresh rate	1 minute

CLI:

config system external-resource
    edit "intrudect-block"
        set type address
        set resource "https://WEB-UI/fw/feed/TOKEN"
        set refresh-rate 1
        set server-identity-check full
    next
end

• server-identity-check (certificate verification) is available from FortiOS 7.0.8 / 7.2.4; the default is none.
• Maximum 131,072 entries and 10 MB per feed; fewer on small models (print tablesize, line system.external-resource).
• If the web UI is unreachable, the FortiGate keeps the last list, also across reboots.

Deny policies

config firewall policy
    edit 0
        set name "Intrudect: from blocked"
        set srcintf "any"
        set dstintf "any"
        set action deny
        set srcaddr "intrudect-block"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set match-vip enable
        set logtraffic all
    next
    edit 0
        set name "Intrudect: to blocked"
        set srcintf "any"
        set dstintf "any"
        set action deny
        set srcaddr "all"
        set dstaddr "intrudect-block"
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
end

Policy	Drops
from blocked	traffic from a blocked address through the FortiGate, including to VIPs (match-vip)
to blocked	traffic from your hosts to a blocked address (IOC, TOR, signature blocks)

New policies are added at the end. Move both above your allow policies and below the accept policies for critical systems:

config firewall policy
    move <Intrudect policy ID> before <first allow policy ID>
end

Traffic to the FortiGate

Firewall policies do not cover traffic to the FortiGate itself. FortiOS 7.4 and later accept the feed in a local-in policy:

config firewall local-in-policy
    edit 0
        set intf "any"
        set srcaddr "intrudect-block"
        set dstaddr "all"
        set action deny
        set service "ALL"
        set schedule "always"
    next
end

Check

• Security Fabric > External Connectors > intrudect-block > View Entries lists the imported addresses.
• The FortiGate appears in Pull logs on the Feed tab.

Remove

Delete the Intrudect deny and local-in policies, then the feed:

config system external-resource
    delete "intrudect-block"
end