Technical Tip: Local In Policy VS Virtual IP Policy

[Dongfang_Li_FTNT]

Description	This article describes a scenario where a user wants to block traffic from certain countries from reaching the internal server behind FortiGate LAN. The IP belonging to the GEO block country is still able to access the internal server. Below are the configs:     Virtual IP(VIP) and its policy allowing traffic from the Internet interface WAN to LAN, source address 'ALL'. GEO block address for the country to be blocked. Local in policy to block any traffic arriving at the WAN interface from the GEO block address.
Scope	FortiGate.
Solution	According to Packet Life in FortiGate, Destination NAT takes effect at the beginning of the packet process. In the FortiGate kernel, packets are processed in the following order: DNAT (Virtual IP). Routing. Policy lookup. Session helper. User authentication. Device identification. SSL VPN. Local management traffic. A local policy with an 'action deny' will not deny traffic allowed by a VIP policy because when the local policy takes effect, the VIP policy has already allowed the traffic.   To resolve the issue. Create a GEO address object. Create a firewall policy and select the source address of the 'GEO address' object. Select the destination VIP. Select the action deny in the policy. Put it on top of the VIP allow policy to block the source GEO block address. Note: The destination address of the deny policy should be set to the VIP address, if set to the normal local server IP address, use CLI to enable match-vip 'set match-vip enable' in the deny policy. The match-vip option is disabled by default until v7.2.3. In versions after 7.2.3, the option is enabled by default. The 'set match-vip' option is only available if the policy action is set to 'deny'.  The following article explains how to configure block VIP access using the GEO location: Technical Tip: How to block VIP access using GEO Location Related documents: Packet flow ingress and egress: FortiGates without network processor offloading Technical Tip: Firewall does not block incoming (WAN to LAN) connection even though deny policy Technical Tip: Local In Policy VS Virtual IP Policy Technical Tip: Using Virtual IPs to configure port forwarding