Visitor III

Solved

Geo-lock access to Windows IKEv2 native VPN

Forum|Forum|2 years ago
May 16, 2024
8 replies
3098 views

Is there a way to geo lock access to Windows IKEv2 native VPN on Fortigate (same as one can do with SSL VPN)?

Seb

FortiGate

Best answer by ozkanaltas

Hello @scerazy ,

Yes, you can use negate option in local-in-policy. You can do this with the negate setting. The negate option means outside the object you use.

For example

config firewall local-in-policy edit 0 set srcaddr-negate enable end

ozkanaltas

Valued Contributor III

Hello @scerazy ,

According to my research, there is no option to restrict incoming connections to dial-up-only VPNs.

You can use local-in-policy for that. But if you configure local-in-policy, that policy affects all ipsec vpn. Because these types of VPNs use the same TCP/UDP ports.

If you want to get more information about local-in-policy you can review these articles.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Inbound-Access-from-Specific-Country-IP/ta-p/264818

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/363127/local-in-policy

scerazyAuthor

Visitor III

Would there be an easy way to do the opposite? Block all, but only allow X Y Z ?

I still do not see how/why local-in is different than normal rules

edit

firewall policy is for traffic going THROUGH the FortiGate.

Local-in is for traffic going TO the FortiGate.

ozkanaltasAnswer

Valued Contributor III

Hello @scerazy ,

Yes, you can use negate option in local-in-policy. You can do this with the negate setting. The negate option means outside the object you use.

For example

config firewall local-in-policy edit 0 set srcaddr-negate enable end

scerazyAuthor

Visitor III

Is GUI not capable displaying CLI created rule entry?

I cannot see it (it shows fine in CLI)

hbac

Staff

Hi @scerazy,

local-in-policy is not configurable on the GUI. Only in the CLI.

Regards,

scerazyAuthor

Visitor III

I did not mean to configure, just to display would be fine (but does not do that either)

It displays other existing bits, but not CLI configured policy

Sign up

Login with SSO

Login to the community

Login with SSO