Fortinet black logo

CLI Reference

config system external-resource

config system external-resource

Use this command to create an IP Address connector that allows you to dynamically import an external block list from an HTTP/HTTPS server in the form of a plain text file. Block lists can be used to enforce special security requirements, such as long term policies to always block access to certain websites, or short term requirements to block access to known compromised locations. The lists are dynamically imported, so that any changes are immediately imported by FortiADC.

After you have imported your external block list through the IP Address connector, you can apply the IPs as the source or destination address for IPv4 and IPv6 firewall policies.

  • You cannot delete an IP Address connector or modify its status if the external resource is being used in an IPv4 or IPv6 firewall policy.
  • Up to 512 external resources can be supported, however, large numbers of external resources may affect system performance.
Requirements:
  • The external block list must be accessible from an HTTP/HTTPS server.
  • The import file must be in plain text and each line must contain an IP, IP Range, or Subnet in the below formats:

    IP/ IP Range/ Subnet

    Example

    IPv4192.168.2.100
    IPv4 Range172.200.1.4/16
    IPv4 Subnet172.16.8.1-172.16.8.100
    IPv62001:0db8::eade:27ff:fe04:9a01
    IPv6 Range2001:0db8::eade:27ff:fe04:9a01/120
    IPv6 Subnet2001:0db8::eade:27ff:fe04:aa01-2001:0db8::eade:27ff:fe04:ab01
  • The maximum import file size is 1 MB (which is about 5000 line entries).

Syntax

config system external-resource

edit <name>

set resource <string>

set type address

set username <string>

set password <string>

set refresh-rate <integer>

set comments <string>

set status {enable|disable}

next

end

resource

Specify the URI of the HTTP/HTTPS server where the IP address list is stored.

username

Specify the username to be used to access this IP address list.

password

Specify the password to be used to access this IP address list.

refresh-rate

Specify the refresh rate in minutes. (Default: 5. Range: 1-43200 minutes).

FortiADC will retrieve the data from the HTTP/HTTPS server periodically according to the refresh rate.

comments

Optionally, enter comments about the IP Address connector.

status

Enable/disable the IP Address connector.

Example

config system external-resource

edit "my_ip_list"

set resource http://10.106.206.243/1.txt

set type address

set username test1

set password passwd

set refresh-rate 5

set status enable

next

end

config system external-resource

Use this command to create an IP Address connector that allows you to dynamically import an external block list from an HTTP/HTTPS server in the form of a plain text file. Block lists can be used to enforce special security requirements, such as long term policies to always block access to certain websites, or short term requirements to block access to known compromised locations. The lists are dynamically imported, so that any changes are immediately imported by FortiADC.

After you have imported your external block list through the IP Address connector, you can apply the IPs as the source or destination address for IPv4 and IPv6 firewall policies.

  • You cannot delete an IP Address connector or modify its status if the external resource is being used in an IPv4 or IPv6 firewall policy.
  • Up to 512 external resources can be supported, however, large numbers of external resources may affect system performance.
Requirements:
  • The external block list must be accessible from an HTTP/HTTPS server.
  • The import file must be in plain text and each line must contain an IP, IP Range, or Subnet in the below formats:

    IP/ IP Range/ Subnet

    Example

    IPv4192.168.2.100
    IPv4 Range172.200.1.4/16
    IPv4 Subnet172.16.8.1-172.16.8.100
    IPv62001:0db8::eade:27ff:fe04:9a01
    IPv6 Range2001:0db8::eade:27ff:fe04:9a01/120
    IPv6 Subnet2001:0db8::eade:27ff:fe04:aa01-2001:0db8::eade:27ff:fe04:ab01
  • The maximum import file size is 1 MB (which is about 5000 line entries).

Syntax

config system external-resource

edit <name>

set resource <string>

set type address

set username <string>

set password <string>

set refresh-rate <integer>

set comments <string>

set status {enable|disable}

next

end

resource

Specify the URI of the HTTP/HTTPS server where the IP address list is stored.

username

Specify the username to be used to access this IP address list.

password

Specify the password to be used to access this IP address list.

refresh-rate

Specify the refresh rate in minutes. (Default: 5. Range: 1-43200 minutes).

FortiADC will retrieve the data from the HTTP/HTTPS server periodically according to the refresh rate.

comments

Optionally, enter comments about the IP Address connector.

status

Enable/disable the IP Address connector.

Example

config system external-resource

edit "my_ip_list"

set resource http://10.106.206.243/1.txt

set type address

set username test1

set password passwd

set refresh-rate 5

set status enable

next

end