Wednesday, August 2, 2017

FortiOS GEOIP tips

The GEO-IP is a feature in fortigate , very simple to use and here's some  tips and tricks for  getting around it.

Here's a few things to considered;

  • Updates are pushed via an active  fortiguard subscriptions to the fortigates under contract
  • It does not support ipv6  GEOIP database at this time
  • There's no manual updates you  can push
  • You can craft  firewall address objects with custom GEOIP data
  • Keep in mind you can't assign a IANA assigned 2 letter GEO id for custom  firewall address


To get the  current   versions of geoip

diag autoupdate versions

IP Geography DB
Version: 1.054
Contract Expiry Date: n/a
Last Update Date: Tue Aug 30 14:10:59 2016


To execute  update request from  command line

diag debug reset
diag debug enable
diag debug application  update -1
execute  update-geo-ip
diag debug  reset 
diag debug disable


To find  network ranges per country

FW01 $ diag firewall ipgeo ip-list ST - - - - -
Country name:ST Total IP Range:5


To find   what country a ipv4 address belongs to;

diag firewall ipgeo ip2country is in country:ZZ

Ken   Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com
     ^      ^
=(  @  @ )=

        /  \

No comments:

Post a Comment