Block external ip's from reaching VPN ports

Forum|Forum|7 years ago
December 19, 2018
3 replies
8169 views

Hi!

Fortigate 60D with 5.6.7

I have a some malicious attempts to connect to VPN/IPSec and I would like these ip addresses blocked before reaching ports 500 and 4500.

How can I block/deny certain ip addresses? I have tried Local-In policy but it does not seem to have an affect when I try myself from an external host. Is Local-In policy able to block like I want and is config correct (see attched photo)?

Thanks!

Regards

Jlax

Policy

ede_pfau

SuperUser

That's what I do, and it does have an effect:

config firewall local-in-policy
    edit 1
        set intf "wan1"
        set srcaddr "VPN_origin_countries"
        set dstaddr "all"
        set action accept
        set service "IKE"
        set schedule "always"
    next
    edit 2
        set intf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set service "IKE"
        set schedule "always"
    next
end

It uses whitelisting which is easier for me as I don't have to collect bad addresses in the first place. Be sure to deny-all (policy2) one specific service only, or you will lose remote access etc.

jlaxAuthor

New Member

If I do a whitelist instead then I have to populate ip's from all Forticlient users?

Thanks again!

Sign up

Login with SSO

Login to the community

Login with SSO