restrict IPSec VPN access from certain countries

1) In FGT GUI, create one address object as below:

2) There is one pre-defined service object called "IKE";

3) Configure two local-in policies as below:

config firewall local-in-policy
edit 1
set intf "internal"  <-------------   This is the interface bound to your IPSec VPN
set srcaddr "UAE"
set dstaddr "all"  <-------   This can be your IPSec VPN local gateway IP (the IP assigned to the interface bound to your IPSec VPN)
set action accept
set service "IKE"
set schedule "always"
next
edit 2
set intf "internal1"    <-----  The interface bound to your IPSec VPN
set srcaddr "all"
set dstaddr "all"    <---- This could be your IPSec VPN local gateway IP
set service "IKE"
set schedule "always"
next
end

NOTE: For policy 2, the action is Deny.