Block Specific IP Addressess of Accessing Firewall from Outside

Hi,

That can be done through local-in policy, from CLI.

Apply policy as below:

Create the Local in Policy to restrict access only to the predefined group on management interface (here: port1):

config firewall local-in-policy

edit 1

set intf port1

set srcaddr "MGMT_IPs"

set dstaddr "all"

set action accept

set service HTTPS HTTP

set schedule "always"

set status enable

next

edit 2

set intf "any"

set srcaddr "all"

set dstaddr "all"

set action deny

set service HTTPS HTTP

set schedule "always"

set status enable

end

If using non default ports, create appropriate service object for GUI administrative access:

config firewall service custom

edit GUI_HTTPS

set tcp-portrange <admin-sport>

next

edit GUI_HTTP

set tcp-portrange <admin-port>

end

Use these objects instead of "HTTPS HTTP "in the local-in policy 1 and 2 below.

Please don't use the "any" interface! You know which interface is connected to the WAN, use the specific port.

The side-effect of using the "any" interface (which must be enabled specifically first) is that you lose the 'interface pair view' in the policy table. And life get's a lot more difficult when debugging.

You should be able to do what you want using the config firewall local-in-policy 

If you enter set int ? you will get a list of all available interfaces that the policy can be applied to. If you just want to block access from a set of IP's then create a group and add the IP's to deny in there.

Then config policy to deny anything in the group and allow what you do want etc.

Oh and you do need to specify the interface so in my example edit 2 should reference port1 as well so code allows traffic to port1 for anything in the MGMT_IPs group and denies all other traffic going to port1 using ports HTTP, HTTPS 

How about configuring trusted hosts?

This Below link tells you how to configure local in policy:

https://docs.fortinet.com/document/fortigate/6.2.13/cookbook/363127/local-in-policies
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Filter-ingress-traffic-going-to-the-FortiGate/ta-p/190268?cmd=displayKC&dialogID=92490886&docType=kc&docTypeID=DT_KCARTICLE_1_1&externalId=FD33649&sliceId=1&stateId=0


A few things I could recommend:
1 Disable any protocol access from your WAN port that's not needed 
2. Change the default port numbers 
3. Use 2-factor authentication for all the admin logins (the FortiGate comes with two free mobile tokens)
4. If you know the IP address that you'll be connecting from for the admin access, then add these to the trusted hosts (configured under each administrator account)= Already done