Fortinet Fortigate NGFW DBL Configuration Guide

Submit a Ticket

To continue with this configuration guide you must first Submit a ticket via the Samurai MDR application. Add the following information within your Ticket:

Submit the ticket and you will hear back from us with additional information (e.g DBL URL) to continue with the configuration below.

Connection Requirements

You will need to ensure your Fortigate device(s) can reach a specific URL to obtain the DBL. This information will be provided to you once subscribed.

Table 1: Connections requirements

To complete this integration you have to:

• Have submitted a ticket via the SamurAi portal and have been provided the necessary DBL endpoint URL/IP address.

From your Fortinet Fortigate Devices or FortiManager:

• Create a Threat Feed External Connector for URL DBL
• Create a Web Filter
• Apply the Web Filter to a Firewall Policy
• Create a Threat Feed External Connector for IP DBL
• Apply the IP DBL to a Firewall Policy

Create a Threat Feed External Connector for URL DBL

1. Follow the Fortinet documentation FortiGuard category external feed. The linked documentation outlines an example, however use the following parameters when creating the feed:

We link the FortiGate / FortiOS 8.0.0 Administration Guide therefore you may need to refer to additional Fortinet documentation.

2. Verify the threat feed has been created and is updating successfully by checking its Status and Last update fields in Security Fabric > External Connectors, and by using View Entries to see the current list.

Create a Web Filter

1. Follow the steps outlined in the same linked Fortinet documentation under the section entitled To apply a FortiGuard category external feed in a web filter profile using the following parameters:

Apply the Web Filter to a Firewall Policy

1. Follow the steps outlined in the same linked Fortinet documentation under the section entitled To apply the web filter profile in a firewall policy using the following parameters:

You may also want to refer to the additional Fortinet documentation - Firewall policy.

Create a Threat Feed External Connector for IP DBL

1. Follow the Fortinet documentation IP address external feed. The linked article outlines an example, however use the following parameters when creating the feed:

2. You can verify the threat feed has been created and view entries by following the View Entries step in the Fortinet documentation.

Apply the IP DBL to a Firewall Policy

1. Follow the steps outlined in the same linked Fortinet documentation under the section entitled To apply an IP address external feed in a firewall policy using the following parameters:

You may also want to refer to the additional Fortinet documentation - Firewall policy.

2. Ensure to set the firewall policy according to your environment and ensure the DENY policy is effective, also setting the Policy_for_SamuraiMDR_IP_DBL at higher order than Policy_for_SamuraiMDR_URL_DBL.

Our Dynamic Block List (DBL) configuration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by Submitting a ticket in the Samurai MDR application and we shall get it updated.