Firewall Fortigate Fortinet SIP – IP Getting Through Firewall Despite Being on Banned List

firewallfortigatefortinetsip

I am facing wearied scenario. We are having a SIP gateway in DMZ, yesterday I have observed malicious traffic hitting SIP gateway from the 212.x.x.209 IP. I immediately Banned this IP in firewall so that traffic get denied on firewall itself but it is getting passed intermediately.

Malicious traffic is coming from all banned IP's but I don't understand why it was getting allowed intermediately?

This issue is related to SIP traffic. We are having Fortigate 100D with firmware v5.6.4

PFA the banned IP list and logs so that you can understand the scenario clearly.

Kindly help me to understand this.

Best Answer

You need to check the Forward Traffic log for which policy is applied for the accepted connections. If you don't see the policy column you need to add it to the display.

Policies are applied in strict order, first match from top to bottom is applied. Likely, you need to resort your policies or refine a previous ACCEPT policy that's too wide.

For a SIP gateway connection I'd accept only the single defined IP address or subnet that it's located on.

Related Solutions

How to get a list of ports listening in a Fortigate firewall

Try with:

diagnose sys tcpsock | grep 0.0.0.0

Routing Through a Firewall to FTP Server

Static routes are just fine. In this case your default gateway should always point towards internet:

FTP server should have default gateway 192.168.0.75
Firewall's default route (0.0.0.0/0) should have next hop 192.168.1.254.

Firewall shouldn't need any other routes. 192.168.0.0/24 and 192.168.1.0/24 are already connected so they should be in the routing table already.

Your router (192.168.1.254) should have static route for 192.168.0.0/24 via 192.168.1.1.

Port forwarding must be done at least on a device with public IP address - router in your case. In this case you don't need to perform NAT nor port forwarding on the firewall it'll just run the firewall rules. Port forwarding on the router should set 192.168.0.162 as new destination address.

You could do port forwarding on both firewall and router but I that's probably counter productive. You cannot perform port forwarding and NAT on firewall only as it isn't reachable from the Internet due to private IP addresses.

Best Answer

Related Solutions

How to get a list of ports listening in a Fortigate firewall

Routing Through a Firewall to FTP Server

Related Topic