Skip to main content
vusal_d
vusal_d
New Member
January 22, 2019
Solved

GeoIP Blocking seems not working

  • January 22, 2019
  • 1 reply
  • 12271 views

I have a rule on my Fortigate (FortiGate 1000D) to block some countries (geoip blocking) But rule seems not working.

Can someone help me to find out why?

 

FortiFw (25) # show
config firewall policy
    edit 25
        set name "GeoIP Block"
        set uuid d40a24de-1cad-51e9-5df4-b01121de63c3
        set srcintf "port9"
        set dstintf "port10"
        set srcaddr "Blocked Countries"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set fsso disable
    next
end
FortiFw (25) #

 

 

 

                 
    Best answer by Markus

    Try to set match-vip enable on this rule.

    config firewall policy

    edit "25"

    set match-vip enable

    end

     

    Best, Markus

    1 reply

    Markus
    MarkusAnswer
    New Member
    January 22, 2019

    Try to set match-vip enable on this rule.

    config firewall policy

    edit "25"

    set match-vip enable

    end

     

    Best, Markus

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    January 22, 2019

    What are you trying to block, which kind of traffic?

    There are 2 main categories:

    - traffic through the FGT

    - traffic to the FGT

     

    The first one is controlled by regular policies, and only applies if you use VIPs (destination NAT). Unless you use public IP addresses on your LAN.

    The second one is controlled by local-in policies. These are configured in the CLI (config firewall local-in).

    They do not only control management traffic (like brute-force SSH attacks on the wan port) but IPsec access also.

    vusal_d
    vusal_dAuthor
    New Member
    January 22, 2019

    ede_pfau wrote:

    What are you trying to block, which kind of traffic?

    - traffic to the FGT . All traffic from above mentioned countries 

     

    ede_pfau wrote:
    The second one is controlled by local-in policies. These are configured in the CLI (config firewall local-in).

     

    where I can read about this?

    Terms & ConditionsAccessibility statement