Technical Tip: Unable to block IKE negotiation with threat feed list

In order to use a threat feed to block IKE traffic, it is required to use a local-in policy.
If on a version above 7.2.4, the following configuration is required for local-in policies to affect IKE traffic:

config system settings
    set detect-unknown-esp disable
end

See more details in this article: Blocking unwanted IKE negotiations and ESP packets with a local-in policy | FortiGate / FortiOS 7.6.3 | Fortinet Document Library.

It is important to know why this is a default in the first place. Generally, it is preferable to have the FortiGate check the SPI of each incoming IKE request. This article goes over the reasoning for this: Technical Tip: ESP Packets are not blocked by local-in policy. 

Once this is disabled, configure the local-in policy as follows:

config firewall local-in-policy     edit 1         set intf "any"         set srcaddr "Threat_Feed_list"         set dstaddr "all"         set service "IKE"         set schedule "always"     next end

It is possible to use multiple threat feed lists under the source object field:

config firewall local-in-policy     edit 1         set intf "any"         set srcaddr "Threat_list1" "Threat_list2" ....         set dstaddr "all"         set service "IKE"         set schedule "always"     next end

After the changes are made, the IKE traffic can be seen as blocked with threat ID and local-in-policy ID information.

Related articles: