New Member

Solved

Blocking external IP addresses

Forum|Forum|10 years ago
February 23, 2016
11 replies
69927 views

Dear All,

I'm new to Fortigate and new to the forum. Anyway, I have a problem configuring policies for blocking unwanted access from some external/malicious IP addresses.

Here's what I did.

config firewall policy
    edit 4
        set uuid 10be693f-5610-45a9-bebc-c27bd394177f
        set srcintf "any"
        set dstintf "any"
        set srcaddr "group-blacklist"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
end

I have put the policy on top of the list. However, when I tried accessing my FW from blocked IP address, it still can go through and no traffic were recorded to the policy log. Am I missing any steps or is there any other way? Thank you guys.

Fortigate 60D

v5.2.6,build711 (GA)

FortiGate

Best answer by ede_pfau

This is not about VIPs but administrative access to the FGT, right?

You can do 2 different things:

1- only allow certain public IPs to access the FGT (white listing) - go to System>Admin>myadmin>TrustedHosts

2- create a local-in policy which uses a predefined custom address group as source address(es). Local-in policies are only managed in the CLI.

Nils

New Member

You need to do the "set action deny".

And try to specify the source and destination-interface, that's best practice.

OkabeAuthor

New Member

I did set the action to deny. In my case, I want to block external IP addresses from accessing my WAN interface. How do I set the source interface and destination interface? Is there an access control list to do that or am I missing anything? Thanks.

Ian_Harrison

New Member

Hi

I had the same problem v5.2.6 , in the end the fix was not to set the dstaddr to all but to specify each of the VIPS. Once I did that the external IP address was blocked and I could see the entries in the log

Hope that helps

Ian

ede_pfauAnswer

SuperUser

This is not about VIPs but administrative access to the FGT, right?

You can do 2 different things:

1- only allow certain public IPs to access the FGT (white listing) - go to System>Admin>myadmin>TrustedHosts

2- create a local-in policy which uses a predefined custom address group as source address(es). Local-in policies are only managed in the CLI.

CodeTron

Explorer II

What is the best way to block an external IP trying to connect to services like IKE ?

I tried to create the following policy with no luck! :

Incoming interface WAN1

Outgoing interface? (IPSEC_VPN or Internal, or ....?) tried both

Source IP address: is set to mach the range of IP that I want to block

Destination addres : is set to all

Service: all

Sechule: always

Action: Deny

The policy is placed at the very top

Also I tried to config the Local-In_policy as follows

Edit 1

set intf WAN1set srcaddr <Group_of_blocked_addresses>set dstaddr <All>set service <IKE>set schedule <Always>

I tried to set the action to deny but it wont accept it!

Any ideas how this is accomplished!! I came from Juniper and denying external IP's was not a project!

Forgot to mention that I limited access to the device by setting the trusted sources to my internal IPs in the admin section to enhance the device security.

Thank you

RichSharp

New Member

I have the same issue. Can anyone out there help>??

Sign up

Login with SSO

Login to the community

Login with SSO