Skip to main content
mouse51180
mouse51180
New Member
July 29, 2019
Solved

Geo Blocking

  • July 29, 2019
  • 1 reply
  • 20627 views

Im in the middle of setting up a policy to block all traffic outside of the US.   It appears I have to add each country to the Policy & Objects > Addresses section separately and then create a group and add the addresses to the group ...then create a policy to block the group.  I have started to do that and it appears to be working fine, but I was wondering if there is a way to create an allow list instead? I thought if I setup a policy to Allow US, but no one else...will this block everyone else?  I didnt know if the data would be read through the security like...data from country b arrives....policy 1: its not US...go to policy 2-9...there are no other policies that "block" country B...allow data.... Or will it be...  data from country  b arrives...policy 1: its not US...blocked...dont care about other policies. It seem like the default is ...if there is no policy...let it through.

    Best answer by ede_pfau

    If I may indecently point you to this page where exactly this is laid out, with ready-to-use batch command files for the geo-objects and an example of how to allow incoming (towards the FGT) traffic from just one country.

     

    I am not 100% sure if the list of geo-objects is identical to that in FortiOS v6.2 but it'll work. The correlation between country name and IP ranges is constantly updated online in FortiOS.

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    July 29, 2019

    Simply put the allowed US polity at the top. Then deny all next, which includes all other countries.

    mouse51180
    mouse51180Author
    New Member
    July 29, 2019

    Tell me if this is correct...

     

    See attached screenshot

     

    I would think that Traffic would come in from the US....hit policy ID 33....it is US based...to it goes to next policy.  Policy ID 31 then checks it and see that it is traffic from the ANY group and then its blocked.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    July 29, 2019

    Actually the "deny all" is implicitly there already. You don't need it. It should be working as you intended with the current set up with the second one "disabled".

    Terms & ConditionsAccessibility statement