Skip to main content
timothyd
New Member
August 16, 2022
Question

Restrict IPSec VPN by IP

  • August 16, 2022
  • 1 reply
  • 6849 views

Hi Everyone,

 

I have an IPSec VPN configured between two locations. The VPN is working great.

 

I've noticed, however, under Log & Report > Events > VPN Events that there are a number of "IPsec phase 1 error" messages, all of which are from unfamiliar IPs. It's obvious that there some bad actors are trying to configure an IPSec VPN against our network. 

 

How can I configure the firewall to block any IPSec VPN attempts, except from known IPs in a whitelist we manage on the Fortinet appliance?

1 reply

Toshi_Esumi
SuperUser
SuperUser
August 16, 2022

The basic idea is you need to use local-in-policy to block all other "IKE" packets except the peer IP you have.

Below KB is to do Geo-blocking for "IKE" attempts. You just need to change the source address for the local-in-policy to your peer address (for accept) and "all" (for deny).


https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restrict-VPN-access-to-certain-countries/ta-p/192328

Toshi

 

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT