Skip to main content
Tutek_OLD
Tutek_OLD
New Member
April 21, 2021
Question

WAN Management for specific public IP only

  • April 21, 2021
  • 1 reply
  • 11292 views

Hello,

I need to open for a short period of time, WAN management to my Fortigate, I know that customer connecting from specific public network subnet let say this is 64.x.x.x/24, how should I configure my Fortigate to allow management on my WAN but only with source from this public subnet?

I know that there is trusted host settings in admin setings page, but I think this is rather Firewall Policy Settings?

    1 reply

    Markus
    Markus
    New Member
    April 21, 2021

    Hello,

    Trusted host setting is "the easy way". If you want to block not only the login, but the gui, this is possible with local-in policies https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/363127/local-in-policies.

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    April 21, 2021

    AS @Markus said the Trusted Hosts for System -> Admin is the way to go. 

    And if you don't have substantial experience with Fortigate & CLI, I'd advise AGAINST playing with Local-in policy - you may lock yourself from management very easily, and in Fortigate there is no "undo" button :)

     

    nicerobot_FTNT
    Staff
    nicerobot_FTNT
    Staff
    April 21, 2021

    Second vote for "restrict login to trusted hosts" in admin settings. LocalIn policies can only restrict srcaddr from CLI and it can get you in to trouble with a lockout. Recommended to have console access available when you start changing LocalIn. You may have to do some LocalIn restrictions during the course of an audit, but you can burn that bridge when you cross it ...

    Terms & ConditionsAccessibility statement