Skip to main content
jimeshmakwana
jimeshmakwana
New Member
June 17, 2020
Question

In dial up IPsec vpn, we do not support user in firewall policy, only support IP address

  • June 17, 2020
  • 1 reply
  • 2133 views

Hi,

we are using fortigate vpn client to access our servers.

 

Our requirement is below

If

VPN User = xxx.vpn

MAC add = xx:b

Time = 06:00 Am to 06:00 PM

 

Then allow below Servers.

Mail_SRV=xx

chat=xxx

I created dial up ipsecvpn & policy vpn to lan

but in policy when i add user then it's not work else it's working

TAC Engineer answer is - In dial up IPsec vpn, we do not support user in firewall policy, only support IP address

 

Jimesh

1 reply

sw2090
SuperUser
sw2090
SuperUser
June 22, 2020

hm

 

Date and Time validity can be achieved by using some schedule in the policy. That would deaktivate the policy if not in schedule. So it will only match traffic within schedule.

 

I think yo could set a user as source for a poliy even with vpn but it will only prompt the user for creds and this will also only work for http and https. It wil not work if you want to do IMAP/POP3 or bascially anything not http(s).

I don't think you can set source to a mac address.

 

You could however use device detection and then set the deivce into the policy to limit it to that device or debice group.

 

Or you could use dhcp over ipsec with client specific reservations and then nail it to the ip address.

 

hth

Sebastian

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!