FortiGate ISDB: Block Malicious Traffic Outbound + Inbound

Описание: In this video, I show how to use Fortinet’s Internet Service Database (ISDB) to build firewall policies that block known malicious IPs for both outbound (LAN→WAN) and inbound (WAN→VIPs/Servers) traffic.

Most people use ISDB to allow popular apps (Teams, Zoom, etc.) without maintaining huge IP lists, but Fortinet also maintains malicious ISDB objects (Botnet C2, phishing, Tor exit nodes, anonymous VPNs, scanners, hosting services, etc). These objects are updated by FortiGuard and can add an extra layer of protection for your north/south traffic.

In the outbound section, I build a deny policy above the normal internet policy, then show how to log and monitor hits, because a match here can be a real IOC worth investigating. Then we move into inbound protection by placing ISDB deny rules above your inbound VIP policies, including blocking scanners and certain hosting categories. Finally, I show how to create ISDB groups and custom objects for more granular control.

Timestamps:
0:00 Intro
0:14 Quick ISDB Intro
1:10 Viewing Malicious ISDB Objects
1:47 Creating an Outbound Policy
4:13 Blocking Additional Services
6:10 Logging, Monitoring, and Testing
7:43 Creating ISDB Groups
9:12 Inbound Protection Intro
10:15 Blocking Malicious Inbound
10:46 Blocking Scanners
12:27 Blocking Hosting Services







Keywords:
FortiGate ISDB, Fortinet Internet Service Database, FortiGate malicious ISDB, FortiGuard ISDB, FortiGate firewall policy, block botnet C2, block phishing, block Tor exit node, block anonymous VPN, FortiGate inbound protection, FortiGate VIP security, FortiGate local-in policy, FortiOS security hardening, Fortinet best practices