Many times there are more than one solution to a problem, and the most obvious is not the best one. I
reminded myself this when came to my care Fortigate 60 unit that was periodically blocking traffic,
you know this not-saying-much system alert “..has reached connection limit” and then no traffic goes from LAN to WAN.
Clearly being a resource starvation issue you may never know for sure what causes this , it may be
oversized rulebase, custom IPS , AV set on everything and everywhere, etc.,.. The only way to pinpoint the
misbehaving component is by elimination – disabling one by one Fortigate UTM protection features until problem disappears. So for this
particular Fortigate firewall it was URL-filtering that was used to block access to the Facebook.com. Unfortunately when you disable it users behind Fortigate would cause starvation of the bandwidth by accessing (or rather not leaving) this
website. An internal fair use policy issue ? – yes of course, but the only way to implement the policy
was by force in this case. So if not URL-filtering (being the obvious solution) then black-hole routing would
be the better one I thought – but in this Fortigate FortiOS 3 i didnt find such option, and as upgrade to FortiOS 4 wasnt
an option I blackholed Facebook.com IP range (thanks to Facebook for the convenience of continuous IP
range ) in the WAN facing Cisco router.
In the Fortigate FortiOS 4 you can configure blackhole routing with no hassle:
Fortigate100 # config router static
Fortigate100 (static) # edit 5
Fortigate100 (5) # set blackhole ?
disable disable setting
enable enable setting
Fortigate100 (5) # set blackhole enable
Fortigate100 (5) # set dst 184.108.40.206/20
Fortigate100 (5) # end
Fortigate100 # show router static
config router static
set blackhole enable
set dst 220.127.116.11 255.255.240.0
From station in LAN:
# ping 18.104.22.168
PING 22.214.171.124 (126.96.36.199) 56(84) bytes of data.
From 10.99.99.254 icmp_seq=1 Destination Net Unreachable
From 10.99.99.254 icmp_seq=2 Destination Net Unreachable
Facebook IP range:
OrgName: Facebook, Inc.
Address: 156 University Ave, 3rd floor
City: Palo Alto
NetRange: 188.8.131.52 – 184.108.40.206