Internet Service combined with Geo-Blocking

Forum|Forum|5 months ago
December 23, 2025
2 replies
874 views

Not too long ago, our cyber team asked us to implement geo-blocking to/from certain countries, which we obliged. Unfortunately, one of our locations can no longer reach a vendor portal they use because it's hosted in Microsoft's cloud in one of these countries with no fixed/static IP's.

In my lab, I was able to work around this by adding a policy allowing access to the Internet Service "Microsoft Azure", but our Cyber team isn't thrilled with how broad this Internet service is (over 50 million IP addresses). They now understand this will override all the other geo-blocking if Microsoft Azure is in the picture and they're not okay with this.

I have no idea how to solve this. What I really need is a way to allow the vanity URL provided by the vendor, and have everything fed up from this URL to be allowed too.

Looking for some suggestions on how to tackle this one?

Denny

FortiGate

Best answer by AEK

You might be looking for this:

https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/336471/allow-creation-of-isdb-objects-with-regional-information

AEKAnswer

SuperUser

You might be looking for this:

https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/336471/allow-creation-of-isdb-objects-with-regional-information

AEK

jokes54321Author

New Member

I want to thank you for directing me to this feature. While it doesn't fully address our cyber teams concern, since it leaves Azure in this one country open, it closes the door on several others they're concerned about. I feel it's an acceptable compromise, until a more robust solution can be implemented.

Denny

AEK

SuperUser

Another solution would be to keep you geo-blocking rule as is, and simply add a new firewall rule on top of it to allow the vendor portal. I guess the vendor portal is reachable by FQDN, right? So you can create a FQDN object that will dynamically update the IP when it changes, and add this object as destination in the new firewall rule.

AEK

lithichok

New Member

Hey, you've got it right. ISP proxies should handle geo-restrictions fine on their own since they use real ISP IPs that websites trust more. For just a month, ISP proxies alone are your best bet. I've had good results with decodo for bypassing geo-blocks – clean IPs and solid performance. Just make sure whatever provider you choose has fresh IPs that aren't already flagged.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded