Technical Tip: Limit administration access by geography location

[ssteo]

Description

This article describes the limited administration access by geography location.

Scope

FortiGate.

Solution

1. Go to Policy & Objects -> Addresses, select 'Create New' -> Address.
   
   In this example, a new geography address with the country Vietnam is created.
   
   

2. The first local in policy is to allow the country Vietnam to connect FortiGate via PORT1.
   
   In this example, PORT1 is a WAN interface that can public accessed from the internet.
   
   config firewall local-in-policy
       edit 0
           set intf port1
           set srcaddr Vietnam
           set dstaddr all
           set service ALL
           set schedule always
           set action accept
    end
   
   
   
   
3. The second local in policy is to block any country from connecting FortiGate via port1. In this example, port1 is a WAN interface that can public access from the internet.
   
   

   config firewall local-in-policy

       edit 0
           set intf port1
           set srcaddr all
           set dstaddr all
           set service ALL
           set schedule always
   end

   
   
4. Now only country Vietnam can access the FortiGate from the Internet.

   Note: Starting from FortiGate v7.6.0, the Local-in-Policy can now be also configured in the GUI. Refer to this document for reference: Technical Tip: Creating a Local-In policy (IPv4 and IPv6) on GUI.