Skip to main content
timothyd
New Member
August 16, 2022
Question

Restrict IPSec VPN by IP

  • August 16, 2022
  • 1 reply
  • 6730 views

Hi Everyone,

 

I have an IPSec VPN configured between two locations. The VPN is working great.

 

I've noticed, however, under Log & ReportEventsVPN Events that there are a number of "IPsec phase 1 error" messages, all of which are from unfamiliar IPs. It's obvious that there some bad actors are trying to configure an IPSec VPN against our network. 

 

How can I configure the firewall to block any IPSec VPN attempts, except from known IPs in a whitelist we manage on the Fortinet appliance?

1 reply

Toshi_Esumi
SuperUser
SuperUser
August 16, 2022

The basic idea is you need to use local-in-policy to block all other "IKE" packets except the peer IP you have.

Below KB is to do Geo-blocking for "IKE" attempts. You just need to change the source address for the local-in-policy to your peer address (for accept) and "all" (for deny).


https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restrict-VPN-access-to-certain-countries/ta-p/192328

Toshi