Geo-block a country with exceptions for SSL VPN

Forum|Forum|1 year ago
October 16, 2024
2 replies
3520 views

Hi

We have noticed a large amount of attempts hitting our SSL VPN from 1 particular country. The attempts are coming from a variety of IP addresses but are listed as this one country. We want to block these attempts but our issue is that we have an office in that country. The users are in a shared office but use SSL VPN to connect to us. The shared office has a static IP.

Is there a way in Fortinet to create a group to block all IP addresses from this country except the 1 that we one that our users connect from?

Many thanks

Roy

jorekco1

New Member

Should work like that. Haven't tested it. This might also be a bit more insecure (not sure), because the check if the connection is allowed is done during authentication, and I believe when setting it globally that check is done before. Haven't tested that either.

rsmAuthor

Explorer

Sorry, What should work like what?

SonaMuvv

Staff

Hello Roy,

You can limit access to specific hosts, Under SSL-VPN settings, choose limit access to specific hosts then add the address groups/countries that you want to allow access to sslvpn login.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-allowing-SSL-VPN-access-from-specific/ta-p/277276#:~:text=In%20the%20GUI%2C%20go%20to%20VPN%20%2D%3E%20SSL%2DVPN,in%20the%20'Hosts'%20section.

rsmAuthor

Explorer

I know how to add create the group to block a country but I want to allow 1 IP from that country and block all the rest. How do I do that?

Toshi_Esumi

SuperUser

With that condition, you need to use local-in-policy. Then you can do in the same way you would do with regular plolicies, like allowing one I with the first policy then block from anywhere else.

https://docs.fortinet.com/document/fortigate/7.4.5/administration-guide/363127/local-in-policy

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded