How to set Fortigate IPsec VPN access restricted by source IP without using Local in Policy?

Forum|Forum|2 years ago
March 8, 2024
3 replies
4334 views

Hello, I searched it in this forum, and finally found a similar topic below.

https://community.fortinet.com/t5/Support-Forum/IPSec-VPN-restricted-by-source-IP-address/m-p/129749?m=51069

But the topic is unresolved.

I already found a way to solve it by using 'Local in Policy'. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restrict-VPN-access-to-certain-countries/ta-p/192328

However, I don't want to use it because of system operation and maintenance considerations, as 'Local in Policy' is supported only through CLI setting.

If you have another idea, could you tell me how to set it?

FortiGate

Best answer by hbac

Hi @studentuser,

If you want to restrict by IP, I believe local-in-policy is the only option. For additional security, you can use peer ID. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Peer-IDs-to-select-an-IPSec-dialup/ta-p/192292

Regards,

hbacAnswer

Staff

Hi @studentuser,

If you want to restrict by IP, I believe local-in-policy is the only option. For additional security, you can use peer ID. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Peer-IDs-to-select-an-IPSec-dialup/ta-p/192292

Regards,

studentuserAuthor

New Member

I wanted to know if someone has other solutions, but it seems there's no other way. Thank you for your prompt reply.

aguerriero

Explorer

You could nat 500/4500 to a loopback address and terminate ipsec on the loopback. Then you would do an outside/wan to loopback policy. On the ipsec configurations you would start using local id configuration as the public address.

If you have multiple publics you could assign a public to the loopback and that would remove the need to do any type of nat or local/remote id changes.

Fortigate used to not be able to offload ipsec to a loopback. I do not know if that changed.