Block VPN SSL from one public IP

6 replies
22196 views

Hello,

I would block SSL VPN access from one public IP.

How can I do that ?

Best regards.

5.6

tanr

New Member

You should be able to use local-in-policy to block a specific IP from being able to access VPN.

Note that you want to be very careful with local-in-policy as you can inadvertently lock yourself out rather easily.

http://kb.fortinet.com/kb/documentLink.do?externalID=FD33649

neonbit

New Member

There's an option in the SSLVPN that allows you to set the source-address as a negate (ie: allow connects from every IP except the ones you specify).

This is configurable in the CLI

config vpn ssl settings

set source-address-negate enable

set source-address "the address object you've configured to block"

end

Steffffi

Explorer

Despite 5 years later, a Big thanks to you! With Fortigate 5.6, there is no exempt list yet availabe from an address group which was introduced in Fortios 6 and 7.

mgoswami

Staff

Hi,

You may refer to the below KB to block SSL VPN connection from a specific IP address:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-SSL-VPN-Connection-from-a-certain/ta-p/206883

BR,

Manosh

Steffffi

Explorer

Thx. With FortiOS 6 and 7, it should be much easier if used to work with CLI. Can use the exempt list or GEO list. But with FortiOS 5, must use the way mentioned above to exyclude for SSL-VPN. Normal block in IP policy wont work.

Sign up

Login with SSO

Login to the community

Login with SSO