Sharing Information with FortiGate

FortiGate will use a Security Fabric Threat Feed Integration to connect to FortiSIEM using watchlist API to pull back the list of IP addresses.

The IP addresses can then be used in a number of scenarios that include:

• Apply threat feed as source in firewall policy to deny access to VIP.

• Apply threat feed as source in a local-in policy to deny IKE/SSL/HTTPS or any administrative access destined to the FortiGate WAN interface.

• Apply threat feed as source SSL VPN or IPsec VPN based firewall policy.