| Description |
This article describes how to use a Threat Feed with SSL VPN. Threat Feeds are not selectable within VPN -> SSL VPN Settings. This article describes the proper way to use them. |
| Scope | FortiGate v6.2.x, v7.x.x. |
| Solution |
It is possible to use a Threat Feed in a local-in policy. This is a simple way to block addresses in the Threat Feed from accessing the VPN. Starting 7.6.0+, the local-in policies can be configured from GUI. Below 7.6.0+, it needs to be configured from CLI only.
Scenario 1: When the SSL VPN is on a Loopback interface.
It is possible then to make a Firewall Policy towards the Loopback, which would then allow to select the Threat Feed as the source.
Here is an example of the Loopback and WAN interface we will be using. The Loopback subnet can be any subnet wanted. However, it should not overlap with any real subnets.
Here is what should be configured in SSL VPN Settings.
It is necessary to make a VIP to forward the SSL VPN port configured above. The External IP should be the WAN IP, and the internal IP should be the IP configured on the Loopback.
The policy is necessary to allow connections from the WAN. The source is negated here, as that will be the most common implementation of the threat feed (allow everything except the Threat Feed).
To enable the source, negate option in the firewall policy, enable it from the CLI using the following commands:
FortiGate# config firewall policy FortiGate (policy_id) # set srcaddr-negate FortiGate (policy_id) # set srcaddr-negate enable
For more details regarding source and destination negate check the following link: Technical Tip: Firewall Policy 'Negate' option
Scenario 2: When the SSL VPN is configured on the WAN interface.
Configure address object for WAN IP and custom service for SSL VPN port.
config firewall address edit "sslvpn_wan"
config firewall service custom
Configure local-in-policy to block the connections from the IP in the threat feed.
config firewall local-in-policy
v7.6.0+:
|
