Technical Tip: How to block unauthorized connections to IPsec VPN

1. Create a local-in policy to block IKE services from the list of unauthorized IPs. However, creating an address object for each IP might be a tedious task, and it might be tiresome if there are a bunch of attempts from multiple different IPs.

config firewall local-in-policy
   edit 1
      set uuid 4884b09a-01d5-51f1-4bbf-791ecad428bd
      set intf "port1"
      set srcaddr "Blocked_IP_Group"
      set dstaddr "all"
      set service "IKE"
      set schedule "always"
   next
end

If there is only a list of specific IPs to connect to the IPsec VPN, which in this case is an IPsec site-to-site VPN with a static remote gateway, it is possible to allow only the remote gateway IP and deny all IKE packets with the use of a local-in policy.

2. Create an address object and address group for the allowed IPsec remote gateway.

3. If there are multiple IPsec VPN connections create an address object for each remote gateway IP and add it to the address group.

4. Create a service for IKE for UDP port 500 and 4500.

5. Apply the IKE service and the newly formed address group to a local-in policy as shown below. Also note the Local-in policy, by default, does not have an implicit deny rule like an IPv4 policy. so a rule will be needed in the end to block IKE traffic for all while the first rule allows specified IPs connection.

    

config firewall local-in-policy
   edit 1
      set uuid 4884b09a-01d5-51f1-4bbf-791ecad428bd
      set intf "port1"
      set srcaddr "VPN_peer_group"
      set dstaddr "all"
      set action accept
      set service "IKE"
      set schedule "always"
   next
   edit 2
      set uuid 95b300a0-0a78-51f1-bcc7-7327ebc4705c
      set intf "any"
      set srcaddr "all"
      set dstaddr "all"
      set service "IKE"
      set schedule "always"
   next
end

The output after creating the local policy to allow only authorized remote gateways. The unauthorized IP is no longer able to negotiate and is no longer present on the VPN event logs.

Note:

This is not applicable for dial-up IPsec VPN peers, as the user's IP might change and be blocked by the local-in policy.

Starting from v7.6.0,  it is possible to create the same policy from the GUI as well: GUI support for local-in policies

After v7.6.1+, local-in policies cannot be configured with individual SD-WAN member interfaces but must be configured with the SD-WAN zone.

For more information, see Troubleshooting Tip: Local-in, Central-SNAT, DoS policies etc are missing after upgrade to FortiOS v7.4.6 or v7.6.1.

Allowing specific IPs to have access while blocking all the other IPs using only one rule:

To allow certain IPs to have access to the IKE while blocking all others. use the option 'srcaddr-negate enable', and use default action 'deny'. In this way the IKE traffic will be allowed to the addresses mentioned in 'Allowed_IPs' and will be blocked for all other IPs 

config firewall local-in-policy
   edit 1
      set uuid 4884b09a-01d5-51f1-4bbf-791ecad428bd
      set intf "port1"
      set srcaddr "Allowed_IPs"
      set srcaddr-negate enable
      set dstaddr "all"
      set service "IKE"
      set schedule "always"
   next
end

Another way to allow specific IP traffic while blocking all others is to use 'Exclude Member' option in address group. Create an Address group with members as all and enable 'Exclude Member' and specify the IPs that needs to be allowed.

Specify this address group in the local-in policy with default action as deny as shown below. 

config firewall local-in-policy
   edit 1
      set uuid 4884b09a-01d5-51f1-4bbf-791ecad428bd
      set intf "port1"
      set srcaddr "Block_IPs-Exclude-Mem"
      set dstaddr "all"

      set action deny
      set service "IKE"
      set schedule "always"
    next
end

To automatically block unauthorized IP addresses, it can be automated with the use of automation stitch.

However, this method has a limitation: if a legitimate user enters an incorrect password, that user's IP address will also be added to the blocklist and need to be removed manually.

Technical Tip: Blocking a failed IPsec VPN login using the automation stitch 

Related articles:
Technical Tip: Restrict IPSec VPN access to certain countries

Technical Tip: Creating a Local-In policy (IPv4 and IPv6) on GUI