Native vpn restrict source IP

Hi,

Yes, you can create local in policy to allow l2tp service from customers public ip. Please see Technical Note: Filter ingress traffic going to th... - Fortinet Community

Best regards,

Jin

Hi Team,

L2TP will use 1701 port and PPTP will use 1723 port for the connection.

You can create service object for both ports and create two local in policies in the firewall:

1. First policy on top is to allow the traffic for specific user machine.

2. Second policy is to block L2TP for rest of the machines.

You can use this article for the reference:

https://docs.fortinet.com/document/fortigate/6.2.10/cookbook/363127/local-in-policies

https://docs.fortinet.com/document/fortigate/6.2.1/cli-reference/245620/firewall-local-in-policy

Please test and keep us posted

But if I go to Local In Policy menu I have here configured two settings with UD 500 and 4500 Port from any source, so this mean any manually created local-in-policy in cli will have higher privileges than those built in?

UDP 500 is IPsec and 4500 is NAT-Traversal. Not sure if restricting these would be enough.

But these are first ports in IPSEC communication so blocking them are crucial.

My question is rather if I configure manually local-in-policy with "set service ike" whether this setting will have higher permissions over the settings (UDP 500,4500) that are already there, because I have already configured other Ipsec tunnels on router ?