Geoblocking Policy not working
Hi Fortigate Gurus ;)
I d'like to block some "bad" sources. For that, I've added some addresses and georegions to a group and created a policy and ordered as first from wan1 to lan.
For example I d'like to block China
name : bad2lan srcintf : "wan1" dstintf : "internal" srcaddr : "bads" dstaddr : "all" rtp-nat : disable learning-mode : disable action : deny status : enable schedule : always schedule-timeout : disable service : "ALL" logtraffic : all logtraffic-start : disable session-ttl : 0 vlan-cos-fwd : 255 vlan-cos-rev : 255 wccp : disable groups : users : devices : natip : 0.0.0.0 0.0.0.0 diffserv-forward : disable diffserv-reverse : disable tcp-mss-sender : 0 tcp-mss-receiver : 0 comments : block-notification : disable custom-log-fields : tags : replacemsg-override-group: srcaddr-negate : disable dstaddr-negate : disable service-negate : disable captive-portal-exempt: disable ssl-mirror : disable ssl-mirror-intf : scan-botnet-connections: disable dsri : disable delay-tcp-npu-sessoin: disable send-deny-packet : disable match-vip : disable edit "bads" set member "geo_china" "geo_vietnam" "geo_korea" "geo_jordan" "geo_russia" "geo_indonesia" set comment "denied_sources"
edit "geo_china" set type geography set country "CN"
In the log I can see failed connection attemps denied by pollicyid 0
Message meets Alert condition date=2017-02-13 time=06:28:43 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=222.186.58.35 srcport=43658 srcintf="wan1" dstip=xxx.xxx.xxx.xxx dstport=9200 dstintf="internal" poluuid=7ff66d8c-d7d4-51e6-9e08-69176710693d sessionid=37228 proto=6 action=deny policyid=0 policytype=policy dstcountry="Switzerland" srccountry="China" trandisp=dnat tranip=xxx.xxx.xxx.xxx tranport=9200 service="" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat="unscanned" crscore=30 craction=131072 crlevel=high
I'm wondering why my deny policy won't work.
Any toughts?
Best regards,
Markus