Technical Tip: Allow IPsec VPN ports and protocol access to specific IP addresses only

This article describes how to allow IPsec VPN port 4500,500 and ESP protocol access to specific IP addresses only.

For instance:

IPsec VPN site-to-site with the remote peer of 10.10.10.1, which opened IKE port 500, NAT-T port 4500, and protocol ESP to all IPs on the Internet.

It will be limited to 10.10.10.1 only.

Port group can be configured from the physical interface under the Network --> Interfaces section:

• Create a firewall address object for the remote peer if not already created:

config firewall address

    edit "RemotePeer1"

        set comment "Remote peer for VPN"

        set subnet 10.10.10.1 255.255.255.255

    next

end

• Create the local in policy to allow IKE and ESP from this peer on port1 (WAN interface):

config firewall local-in-policy

    edit 1

        set intf "LAN(port1)"

        set srcaddr "RemotePeer1"

        set dstaddr "all"
        set action accept

        set service "IKE" "ESP"

        set schedule "always"

    next

    edit 2

        set intf "LAN(port1)"

        set srcaddr "all"

        set dstaddr "all"

        set action deny

        set service "IKE" "ESP" <----- 'IKE' (includes ports 500 and 4500).

        set schedule "always"

    next

end

• These policies are also traversed from top to bottom. The IKE and ESP protocols will be denied from any source that is not part of 'RemotePeer1', and the sources under 'RemotePeer1' will be able to connect.
• Alternatively, a single local-in policy rule can also be created by using the 'Negate' option and will perform the same task. Here is the configuration when using the srcaddr-negate enable option.

config firewall local-in-policy

    edit 0

        set intf "LAN(port1)"

        set srcaddr "RemotePeer1"

        set dstaddr "all"
        set action deny

        set service "IKE" "ESP"

        set schedule "always"

        set srcaddr-negate enable <-- This command will negate the rule and will block all source addresses except those defined in the 'srcaddr' field.

    next

end

The FortiGate will only answer to this remote peer 10.10.10.1 on port 500 UDP for IKE, port 4500 for NAT Traversal, and to protocol ESP on Phase2 VPN.

Note:

Local-in policy is the policy guarding/protecting the FortiGate, i.e., it filters/restricts access when the destination is one of the FortiGate interfaces and its IPs.

Local-in policy tab is disabled in FortiGate GUI by default. To enable, go to System → Feature Visibility → Local-in Policy to make it visible.

The GUI displays only default local-in policies, created automatically by the FortiGate when appropriate services are enabled. Custom local-in policies must be configured using the CLI. The GUI will not show any rules configured in the CLI, which may create confusion by making it seem as though the CLI-configured rules are not active. 

The local-in policy tab is visible in the GUI by default starting from FortiOS 7.6.x.

Starting from FortiOS v7.6.0, local-in policy can also be configured and edited via the GUI: Technical Tip: Creating a Local-In policy (IPv4 and IPv6) on GUI.

There are separate IPv4 and IPv6 local-in policies. The default action in rules is 'denied', so when no action is visible in the show output, it means the action is denied.

Virtual IPs (VIPs) override Local-in policies.

By default, Local-in policy hits are not logged; it is necessary to set in Log Settings → Log All for denied packets to be logged.

The logs are in the Local Traffic section.

It is possible to use Workspace Mode to prevent mistakenly locking out when changing the Local-in policy.