Technical Tip: Limiting management access to a dedicated management interface by IP

When 'dedicated-to management' is configured, it is possible to limit access using trust-ip. This is similar to what is available with Trusted-Host under 'System Admin'.

Below is the interface port10 that has been set 'dedicated-to management'.

In this example, only 10.1.1.101/32 is allowed access to FortiGate management through this port10 interface. Other IPs would be denied.

The logs below show denied IPs:

It is possible to add up to 3 IPv4 and 3 IPv6 trust-ips.

Note:

For IPv6 the command is:

config system interface

    edit <interface>
        set trust-ip6-1 <IPv6-address>/<subnet-mask>

    next

end

Note:

Another way to allow only specific IP(s) is by configuring local-in policies to restrict access.

Related documents:

• CLI Interface Configuration
• Technical Tip:How to dedicate an interface to management