CTIF
← All integrations

FortiGate

Register the feed as an external threat feed connector and use it as a source address in a firewall policy.

Plan needed
Base, SMB, SOC or an active trial
Written against
FortiOS 7.x.

Configure in the GUI

  1. 1Security Fabric, External Connectors, Create New, Threat Feeds, IP Address.
  2. 2URI of external resource: https://ctif.orvteam.com/api/blocklist?format=txt&min_score=70&limit=50000&key=YOUR_API_KEY
  3. 3Refresh Rate: 60 minutes.
  4. 4Save, then View Entries to confirm the addresses arrived.
  5. 5Use the connector as the Source in a firewall policy with action Deny, above your allow rules.

Or in the CLI

config system external-resource
  edit "ctif-hostile-ip"
    set type address
    set resource "https://ctif.orvteam.com/api/blocklist?format=txt&min_score=70&limit=50000&key=YOUR_API_KEY"
    set refresh-rate 60
  next
end

Notes

FortiOS limits the number of entries per external resource by model and firmware. If the connector reports a truncated list, lower limit= or raise min_score until it fits.

If it does not work

Send the exact URL with the key redacted, the UTC time and the response you got to support@orvteam.com. Response targets are on the support page, and current service health is on the status page.