Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Handbook

IP Address Connector

Creating an IP Address connector allows you to dynamically import an external block list from an HTTP/HTTPS server in the form of a plain text file. Block lists can be used to enforce special security requirements, such as long term policies to always block access to certain websites, or short term requirements to block access to known compromised locations. The lists are dynamically imported, so that any changes are immediately imported by FortiADC.

After you have imported your external block list through the IP Address connector, you can apply the IPs as the source or destination address for IPv4 and IPv6 firewall policies.

  • You cannot delete an IP Address connector or modify its status if the external resource is being used in an IPv4 or IPv6 firewall policy.
  • Up to 512 external resources can be supported, however, large numbers of external resources may affect system performance.
Requirements:
  • The external block list must be accessible from an HTTP/HTTPS server.
  • The import file must be in plain text and each line must contain an IP, IP Range, or Subnet in the below formats:

    IP/ IP Range/ Subnet

    Example

    IPv4 192.168.2.100
    IPv4 Range 172.200.1.4/16
    IPv4 Subnet 172.16.8.1-172.16.8.100
    IPv6 2001:0db8::eade:27ff:fe04:9a01
    IPv6 Range 2001:0db8::eade:27ff:fe04:9a01/120
    IPv6 Subnet 2001:0db8::eade:27ff:fe04:aa01-2001:0db8::eade:27ff:fe04:ab01
  • The maximum import file size is 1 MB (which is about 5000 line entries).
To create and configure an IP Address connector:
  1. Go to Security Fabric > External Connectors.
  2. Click Create New.
  3. Under Threat Feeds, click IP Address to display the configuration editor.
  4. Configure the following IP Address settings:

    Setting

    Description

    Name Specify the name of the IP Address connector. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.
    URI of External Resource Specify the URI of the HTTP/HTTPS server where the IP address list is stored.
    HTTP Basic Authentication Enable/disable HTTP Basic Authentication to require username and password to access the IP address list.
    Username

    The Username option is available if HTTP Basic Authentication is enable.

    Specify the username to be used to access this IP address list.

    Password

    The Password option is available if HTTP Basic Authentication is enable.

    Specify the password to be used to access this IP address list.

    Refresh Rate

    Specify the refresh rate in minutes. (Default: 5. Range: 1-43200 minutes).

    FortiADC will retrieve the data from the HTTP/HTTPS server periodically according to the refresh rate.

    Comments Optionally, enter comments about the IP Address connector.
    Status Enable/disable the IP Address connector.
  5. Click Save.
    The newly created IP Address connector appears on the External Connectors page under Threat Feeds.
To view the external block list IP entries and the resource update status:
  1. Go to Security Fabric > External Connectors.
  2. Under Thread Feeds, double-click the IP Address Connector to display the configuration editor.
  3. From the Last Update field, you can see the date of when the resource was last updated.
  4. Click View Entries to display the IP address list entries.
    A dialog appears displaying the entries imported for the IP Address Connector.

    The imported file has been parsed line by line and marked as valid or invalid based on whether the entry meets format requirements for IP, IP Range, or Subnet.

IP Address Connector

Creating an IP Address connector allows you to dynamically import an external block list from an HTTP/HTTPS server in the form of a plain text file. Block lists can be used to enforce special security requirements, such as long term policies to always block access to certain websites, or short term requirements to block access to known compromised locations. The lists are dynamically imported, so that any changes are immediately imported by FortiADC.

After you have imported your external block list through the IP Address connector, you can apply the IPs as the source or destination address for IPv4 and IPv6 firewall policies.

  • You cannot delete an IP Address connector or modify its status if the external resource is being used in an IPv4 or IPv6 firewall policy.
  • Up to 512 external resources can be supported, however, large numbers of external resources may affect system performance.
Requirements:
  • The external block list must be accessible from an HTTP/HTTPS server.
  • The import file must be in plain text and each line must contain an IP, IP Range, or Subnet in the below formats:

    IP/ IP Range/ Subnet

    Example

    IPv4 192.168.2.100
    IPv4 Range 172.200.1.4/16
    IPv4 Subnet 172.16.8.1-172.16.8.100
    IPv6 2001:0db8::eade:27ff:fe04:9a01
    IPv6 Range 2001:0db8::eade:27ff:fe04:9a01/120
    IPv6 Subnet 2001:0db8::eade:27ff:fe04:aa01-2001:0db8::eade:27ff:fe04:ab01
  • The maximum import file size is 1 MB (which is about 5000 line entries).
To create and configure an IP Address connector:
  1. Go to Security Fabric > External Connectors.
  2. Click Create New.
  3. Under Threat Feeds, click IP Address to display the configuration editor.
  4. Configure the following IP Address settings:

    Setting

    Description

    Name Specify the name of the IP Address connector. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.
    URI of External Resource Specify the URI of the HTTP/HTTPS server where the IP address list is stored.
    HTTP Basic Authentication Enable/disable HTTP Basic Authentication to require username and password to access the IP address list.
    Username

    The Username option is available if HTTP Basic Authentication is enable.

    Specify the username to be used to access this IP address list.

    Password

    The Password option is available if HTTP Basic Authentication is enable.

    Specify the password to be used to access this IP address list.

    Refresh Rate

    Specify the refresh rate in minutes. (Default: 5. Range: 1-43200 minutes).

    FortiADC will retrieve the data from the HTTP/HTTPS server periodically according to the refresh rate.

    Comments Optionally, enter comments about the IP Address connector.
    Status Enable/disable the IP Address connector.
  5. Click Save.
    The newly created IP Address connector appears on the External Connectors page under Threat Feeds.
To view the external block list IP entries and the resource update status:
  1. Go to Security Fabric > External Connectors.
  2. Under Thread Feeds, double-click the IP Address Connector to display the configuration editor.
  3. From the Last Update field, you can see the date of when the resource was last updated.
  4. Click View Entries to display the IP address list entries.
    A dialog appears displaying the entries imported for the IP Address Connector.

    The imported file has been parsed line by line and marked as valid or invalid based on whether the entry meets format requirements for IP, IP Range, or Subnet.