FortiGate

Athena can block attacking addresses on a FortiGate from an alert, a policy rule or Pallas. It keeps them in one address group that your own deny policies use. Athena adds and removes its own address objects in that group (athena-<ip>, one per blocked address) and never edits your policies.

Single IPv4 addresses only for now.

On the FortiGate

You need FortiOS 6.4 or later with the REST API reachable from the Athena server (the HTTPS admin port).

1. Address group. Under Policy & Objects → Addresses, create an address group called Athena-Blocked (or another name you then enter in Athena). FortiOS does not allow an empty group, so give it the built-in address none as its only member. Athena leaves none in place.
2. Deny policies. Under Policy & Objects → Firewall Policy, add policies with action DENY that use the group, above the policies that allow traffic:
   • Athena block - from: source Athena-Blocked, destination all, from the internet-facing interface to the inside ones, service ALL.
   • Athena block - to: source all, destination Athena-Blocked, from the inside interfaces to the internet-facing one, service ALL.
3. Admin profile. Under System → Admin Profiles, create a profile (for example athena-blocking) with Firewall → Address set to Read/Write and everything else None.
4. API administrator. Under System → Administrators → Create New → REST API Admin, create athena-api with that profile, Trusted Hosts set to the Athena server's address, and the VDOM that holds the group. Copy the API key it shows: it is shown once.

The address group, the policies and the profile are yours: Athena only needs to read the group and add or remove its own members.

In the console

Admin → Integrations → FortiGate:

Field	Notes
FortiGate admin URL	For example https://10.0.0.1, with :port if the admin port is not 443
API token	The REST API admin's key. Never shown again once saved
VDOM	Empty: root
Address group	Empty: Athena-Blocked
Check the FortiGate certificate	Off for the self-signed certificate FortiGates ship with

Values cannot contain spaces, $, #, quotes or backquotes; a FortiGate API key never does.

Then Test connection: it signs in and reads the address group (nothing is changed), and shows how many addresses Athena has blocked. Save applies the change within a minute, and the Block dialog then offers Block on FortiGate.

How a block works

• Block: Athena creates the address athena-<ip> (a /32, with the reason as its comment) and adds it to the group. Blocking an address twice changes nothing.
• Unblock: Athena takes the address out of the group and deletes it. If the address is also used somewhere else, FortiOS keeps it; the address is no longer blocked either way.

FortiOS limits how many members a group can have (it depends on the model, typically a few hundred to a few thousand). Unblock addresses you no longer need.