Newbie - Re: fortigate 90E login failed alerts from blocked countries

Forum|Forum|6 years ago
February 13, 2020
8 replies
7352 views

Hello

We, as others, are trying to block certain repeat offender (countries) from attempting to and/or accessing our firewall.

We have a blocked-countries-group working with a deny all policy at the top of the list. I receive admin alerts and I get several login attempts with src IP belonging to countries from that group. Should that be happening? I thought having that policy in place would essentially result in any and all packets coming from the blocked countries to just be dropped

Any clarification or guidance is appreciated

Thx

Dave_Hall

New Member

What you want to use is a Local-In policy for traffic directed at the Fortigate's front door.

MannycAuthor

New Member

Hello Dave

Thank you for replying. I don't know that much about router configs etc. If you don't mind can you explain the following:

1- What exactly is the existing policy doing for us? (our fortigate was config'd and put in place by a vendor - we don't know enough to make changes and feel confident they are done correctly)

2-The local-in policy you mention, is that something that can be done via the gui?

3-what is the difference between what you suggest and what is in place?

Thx

Dave_Hall

New Member

The fgt has a number of "open" ports that it listens in on, including ports for administrative access. Local-in policies (for the most part) are meant to control (block or allow) this access.

Here is a script example:

config firewall address edit "China-Country" set type geography set associated-interface "wan1" set country "CN" next end

config firewall addrgrp edit "blocked-countries-group" set member "China-Country" next end

config firewall local-in-policy edit 1 set intf "wan1" set srcaddr "blocked-countries-group" set dstaddr "all" set service "ALL" set schedule "always" next end

(code snippy is from 5.2.)

But if you merely want to restrict admin log in access to local or trusted hosts (as tioeudes noted above) you may be better off doing that. The section on restricting administrative access can be found here.