Skip to main content
tio3udes
tio3udes
Explorer III
August 1, 2022
Solved

Delete Local-in Policy

  • August 1, 2022
  • 2 replies
  • 12903 views

Hello Everyone.

 

So, I'm managing a client's Azure deployed fortigate, which has some local-in policies i'd like to get rid off, so it won't accept connections on a specific interface.

 

The problem is that the local in policies are not editable via gui, and via cli they don't even show. I can create new ones and all but, I would really like to simply delete the ones i don't need.

 

Even on a show full-config output the local in policies dont appear.

 

Anyone know how to delete these policies?

 

#fortigate

Best answer by pminarik

Then it would mean that in this case it cannot be removed at all.

 

Anyway, if you don't have any IPsec configured, that means that there's nothing listening on ports 500/4500, so any incoming packet destined for these ports will be dropped regardless.

2 replies

pminarik
Staff
pminarik
Staff
August 1, 2022

You can only delete/modify local-in policies that are visible in "config firewall local-in-policy". Anything else that isn't listed there but is visible in GUI is controlled automatically by the system, and you cannot manually remove them. (at best you can override-those with new local-in policies with deny action)

    tio3udes
    tio3udesAuthor
    Explorer III
    August 1, 2022

    Thank's for the reply, even thought it confirmed my fears hehe!

     

    So, on the same subjetc, a different question. Since these are controlled automatically by the system i understand that if I create a IPSEC vpn, udp 500/4500 are enabled on the ipsec listening interface, is that right? If so, on the same line of thought, if I delete the ipsec configuration, should the local-in policy be deleted too?

     

    I ask, because I tried to apply this stratagy to get rid off the policies, and it didn't work.

    pminarik
    Staff
    pminarikAnswer
    Staff
    August 1, 2022

    Then it would mean that in this case it cannot be removed at all.

     

    Anyway, if you don't have any IPsec configured, that means that there's nothing listening on ports 500/4500, so any incoming packet destined for these ports will be dropped regardless.

      Yurisk
      SuperUser
      Yurisk
      SuperUser
      August 1, 2022

      Interesting question and observation. From my experience, shutting down some service not necessary closes its ports on the Fortigate. Only that I never had the incentive/time to investigate this further :). Following to get updates.

        Terms & ConditionsAccessibility statement