Blocking Private VPN IPs

If other legit accesses come from the same IPs, you obviously can't block it by "IPs" at L3 level.

Toshi

Thanks.  I would like a "Private VPN" object that Fortinet provides, similar to the Geoblock Country object list, that Fortinet provides now.  This would allow us to block all access from Private VPN IPs; the list would be updated as part of the regular security updates.

I see "VPN-Anonymous.VPN" category in the internet service list when I seached with a keyword "VPN".
https://www.fortiguard.com/search?q=VPN&engine=1&type=isdb
It says "VPN - Servers providing Anonymizing VPN service, such as NordVPN". If this is what you're looking for you can use it in the policy as a source address to block them.

Toshi

We use a Netscaler to front the web servers now.  So yes, we use "VIP," but on the Netscaler, not the Fortigate.  The Netscalers are behind the Fortigate.  If I try to add the way you illustrate in your screenshot, I receive a message "Source addresses/groups must have different IP versions than source Internet Services."

Yes, I did fill out the entire rule.  I believe the error, "Source addresses/groups must have different IP versions than source Internet Services" was related to the fact that I was trying to add VPN-Anonymous to an existing DENY rule.  I created a new DENY rule with just the VPN-Anonymous group in it, and I was able to save it.  However, when I connect to my NordVPN, I am able to access all of our external websites.  So the rule isn't triggering for some reason.

Then you likely need to open a ticket at TAC and get it troubleshot. It's difficult to do that over this community thread "half-duplex" conversation without getting in your FGT.

Toshi