FortiGate

Schildmark can block attacking addresses on a FortiGate from an alert, a policy rule or Schildmark Analyst. It keeps them in one address group that your own deny policies use. Schildmark adds and removes its own address objects in that group (athena-<ip>, one per blocked address) and never edits your policies.

Single IPv4 addresses only for now.

On the FortiGate

You need FortiOS 6.4 or later with the REST API reachable from the Schildmark server (the HTTPS admin port).

1. Address group. Under Policy & Objects → Addresses, create an address group called Schildmark-Blocked (or another name of your choice). FortiOS does not allow an empty group, so give it the built-in address none as its only member. Schildmark leaves none in place.
2. Deny policies. Under Policy & Objects → Firewall Policy, add policies with action DENY that use the group, above the policies that allow traffic:
   • Schildmark block - from: source Schildmark-Blocked, destination all, from the internet-facing interface to the inside ones, service ALL.
   • Schildmark block - to: source all, destination Schildmark-Blocked, from the inside interfaces to the internet-facing one, service ALL.
3. Admin profile. Under System → Admin Profiles, create a profile (for example schildmark-blocking) with Firewall → Address set to Read/Write and everything else None.
4. API administrator. Under System → Administrators → Create New → REST API Admin, create schildmark-api with that profile, Trusted Hosts set to the Schildmark server's address, and the VDOM that holds the group. Copy the API key it shows: it is shown once.

The address group, the policies and the profile are yours: Schildmark only needs to read the group and add or remove its own members.

In the console

Admin → Integrations → FortiGate:

Field	Notes
FortiGate admin URL	For example https://10.0.0.1, with :port if the admin port is not 443
API token	The REST API admin's key. Never shown again once saved
VDOM	Empty: root
Address group	The name of the group you created, for example Schildmark-Blocked. Left empty when you first set the integration up, Schildmark-Blocked is saved. An integration set up with an earlier release and this field left empty keeps using the group name that release used; enter a name to change it
Check the FortiGate certificate	Off for the self-signed certificate FortiGates ship with

Values cannot contain spaces, $, #, quotes or backquotes; a FortiGate API key never does.

Then Test connection: it signs in and reads the address group (nothing is changed), and shows how many addresses Schildmark has blocked. Save applies the change within a minute, and the Block dialog then offers Block on FortiGate.

How a block works

• Block: Schildmark creates the address athena-<ip> (a /32, with the reason as its comment) and adds it to the group. Blocking an address twice changes nothing.
• Unblock: Schildmark takes the address out of the group and deletes it. If the address is also used somewhere else, FortiOS keeps it; the address is no longer blocked either way.

FortiOS limits how many members a group can have (it depends on the model, typically a few hundred to a few thousand). Unblock addresses you no longer need.