FortiOS integration guide.

Check the appliance first

Use an IP address external feed on a supported FortiOS release. The commands below follow the FortiOS 7.x external-resource interface; the linked workflow uses FortiOS 7.6. Verify your model's combined entry and file-size limits before importing. Fortinet documents truncation when a feed exceeds capacity. See external feed limits.

Back up the configuration. Confirm that the selected VDOM can resolve and reach the HTTPS source, has a correct system clock and trusts its certificate chain. Keep a separate trusted management session available.

Create the IP address feed

In Security Fabric → External Connectors → Create New, select the IP address feed type. Choose the external feed retrieval method, paste one URL below, leave basic authentication disabled and select a 120-minute refresh. See Fortinet's connector workflow.

Standard

94,998 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

104,852 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 21 Oct 2026, 00:05 UTC. Check live counts and SHA-256.

The equivalent CLI below creates or updates DataShieldStandard in the current VDOM. Review that name before running it. For Critical, change the name to DataShieldCritical and replace the resource URL with the Critical URL above. Configure only the profile you intend to enforce.

config system external-resource
    edit "DataShieldStandard"
        set status enable
        set type address
        set resource "https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt"
        set refresh-rate 120
        set server-identity-check full
    next
end

Full identity checking validates the certificate and hostname. Do not work around a failed download by selecting none. The external-resource CLI reference documents these settings.

Apply an inbound deny policy

1. Open Policy & Objects → Firewall Policy and create a dedicated policy named Data-Shield inbound.
2. Select the actual Internet ingress interface and the destination interface or zone containing your protected services. Set the source to the external feed. Scope destination objects to those services.
3. Select Deny, the relevant services or all services for the chosen destinations, an always-active schedule and logging.
4. Place the policy before rules that would accept the same incoming traffic. Review the resulting order before applying.

Verify retrieval and enforcement

Inspect connector status, the most recent successful update and imported entries. Use these read-only diagnostics in the same VDOM. The detailed list can produce substantial output.

diagnose sys external-resource stats DataShieldStandard
diagnose sys external-address-resource list DataShieldStandard

These commands are documented in the FortiOS diagnostic reference. Require zero invalid or truncated entries. Compare counts with the publication that was actually retrieved; range aggregation can change displayed totals. Confirm a new controlled inbound connection hits the intended deny policy in traffic logs.

Refresh, exceptions and rollback

Monitor connector errors and stale retrievals. Review a false positive with the whitelist request form; the published exception reaches this firewall after its next successful refresh. Retain narrow local exceptions only where needed.

To roll back, disable the newly created deny policy first and verify required connectivity. Remove its feed reference before deleting the connector. Do not clear the appliance's entire session table as a routine validation step.