FortiGate ISDB: Block Malicious Traffic Outbound + Inbound скачать в хорошем качестве

FortiGate ISDB: Block Malicious Traffic Outbound + Inbound

In this video, I show how to use Fortinet’s Internet Service Database (ISDB) to build firewall policies that block known malicious IPs for both outbound (LAN→WAN) and inbound (WAN→VIPs/Servers) traffic. Most people use ISDB to allow popular apps (Teams, Zoom, etc.) without maintaining huge IP lists, but Fortinet also maintains malicious ISDB objects (Botnet C2, phishing, Tor exit nodes, anonymous VPNs, scanners, hosting services, etc). These objects are updated by FortiGuard and can add an extra layer of protection for your north/south traffic. In the outbound section, I build a deny policy above the normal internet policy, then show how to log and monitor hits, because a match here can be a real IOC worth investigating. Then we move into inbound protection by placing ISDB deny rules above your inbound VIP policies, including blocking scanners and certain hosting categories. Finally, I show how to create ISDB groups and custom objects for more granular control. Timestamps: 0:00 Intro 0:14 Quick ISDB Intro 1:10 Viewing Malicious ISDB Objects 1:47 Creating an Outbound Policy 4:13 Blocking Additional Services 6:10 Logging, Monitoring, and Testing 7:43 Creating ISDB Groups 9:12 Inbound Protection Intro 10:15 Blocking Malicious Inbound 10:46 Blocking Scanners 12:27 Blocking Hosting Services Keywords: FortiGate ISDB, Fortinet Internet Service Database, FortiGate malicious ISDB, FortiGuard ISDB, FortiGate firewall policy, block botnet C2, block phishing, block Tor exit node, block anonymous VPN, FortiGate inbound protection, FortiGate VIP security, FortiGate local-in policy, FortiOS security hardening, Fortinet best practices