Skip to main content
scerazy
scerazy
Visitor III
May 16, 2024
Solved

Geo-lock access to Windows IKEv2 native VPN

  • May 16, 2024
  • 3 replies
  • 3096 views

Is there a way to geo lock access to Windows IKEv2 native VPN on Fortigate (same as one can do with SSL VPN)?

 

Seb

Best answer by ozkanaltas

Hello @scerazy ,

 

Yes, you can use negate option in local-in-policy. You can do this with the negate setting. The negate option means outside the object you use.

 

For example

 

config firewall local-in-policy edit 0 set srcaddr-negate enable end

 

 

3 replies

ozkanaltas
ozkanaltas
Valued Contributor III
May 16, 2024

Hello @scerazy ,

 

According to my research, there is no option to restrict incoming connections to dial-up-only VPNs.

 

You can use local-in-policy for that. But if you configure local-in-policy, that policy affects all ipsec vpn. Because these types of VPNs use the same TCP/UDP ports.

 

If you want to get more information about local-in-policy you can review these articles.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Inbound-Access-from-Specific-Country-IP/ta-p/264818

 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/363127/local-in-policy

 

    scerazy
    scerazyAuthor
    Visitor III
    May 16, 2024

    Would there be an easy way to do the opposite? Block all, but only allow X Y Z ?

     

    I still do not see how/why local-in is different than normal rules

     

    edit

    firewall policy is for traffic going THROUGH the FortiGate.

    Local-in is for traffic going TO the FortiGate.

    ozkanaltas
    ozkanaltasAnswer
    Valued Contributor III
    May 16, 2024

    Hello @scerazy ,

     

    Yes, you can use negate option in local-in-policy. You can do this with the negate setting. The negate option means outside the object you use.

     

    For example

     

    config firewall local-in-policy edit 0 set srcaddr-negate enable end

     

     

      scerazy
      scerazyAuthor
      Visitor III
      May 16, 2024

      Is GUI not capable displaying CLI created rule entry?

      I cannot see it (it shows fine in CLI)

      hbac
      Staff
      hbac
      Staff
      May 16, 2024

      Hi @scerazy,

       

      local-in-policy is not configurable on the GUI. Only in the CLI.

       

      Regards, 

        scerazy
        scerazyAuthor
        Visitor III
        May 17, 2024

        I did not mean to configure, just to display would be fine (but does not do that either)

        It displays other existing bits, but not CLI configured policy

        Terms & ConditionsAccessibility statement