Skip to main content
gilfalko
gilfalko
New Member
May 3, 2014
Question

Limiting SSH access from certain IPs

  • May 3, 2014
  • 3 replies
  • 25240 views
Hey, Is there a way to limit the SSH access to the unit from certain IPs? Thanks!

    3 replies

    Dave_Hall
    Dave_Hall
    New Member
    May 3, 2014
    Depending on what you have in mind, you need to configure the Administrative Access for the Interface in question then go into the Admin settings to enable " Restrict this Admin Login from Trusted Hosts Only" then set the IP address(es). You can also set the actual port access for SSH from 22 to some other port under " system>Admin>Settings>Administration Settings>SSH Port" . (For something non-standard or fancy (not advisable) may be look at " config firewall local-in-policy" .)
    gilfalko
    gilfalkoAuthor
    New Member
    May 3, 2014
    Thanks for the reply dave! This might just work out for me. I have a handful of admin accounts. I guess I' ll have to limit them all then. Thanks alot!
    Dave_Hall
    Dave_Hall
    New Member
    May 3, 2014
    I mentioned the local-in-policy thing because one of our clients requested that we block an entire country from attempting to connect to the their fgt, but personally I don' t like putting something like that in because a setting like that may be easily missed in troubleshot admin connection issues.
    gilfalko
    gilfalkoAuthor
    New Member
    May 3, 2014
    Dave, in my case I need to grant access for our Nagios server from outside in order to run some Event Handler scripts on the forti unit. I' d like to grant just this user the access and specifically from the Nagios server address. But this might come in handy someday afterall. btw, Is " China-Country" a pre-saved variable?
    rickards
    rickards
    New Member
    May 5, 2014
    It is and Firewall Adress that is based on GEO IP with China as country with an arbitrary name.
    Terms & ConditionsAccessibility statement