Technical Tip: Local In Policy VS Virtual IP Policy

[Dongfang_Li_FTNT]

Description	This article describes a scenario where a user wants to block traffic from certain countries to reach the internal server behind FortiGate Lan. The IP belonging to the GEO block country is still able to reach the internal server. Below are the config:     Virtual IP(VIP) and its policy allowing traffic from Internet interface Wan to Lan, source addr 'ALL'. GEO block address for the country to be blocked. Local in policy to block any traffic arriving at WAN interface from the GEO block address.
Scope	FortiGate.
Solution	According to packet life in FortiGate, Destination NAT takes effect at the beginning of the packet process. In the FortiGate kernel, packets are processed in the following order: DNAT (Virtual IP). Routing. Policy lookup. Session helper. User authentication. Device identification. SSL VPN. Local management traffic. Local in policy with action deny will not deny traffic allowed by VIP policy because when Local in policy takes effect, the VIP policy already allows the traffic.   To resolve the issue, create a VIP deny policy and put it on top of the VIP allow policy to block the source GEO block address. Note: The destination address of the deny policy should be set to the VIP address, if set to the normal local server IP address, use CLI to enable match-vip 'set match-vip enable' in the deny policy. The following article explains How to configure block VIP access using GEO location: How to block VIP access using GEO Location Related documents: Packet flow ingress and egress: FortiGates without network processor offloading Technical Tip: Firewall does not block incoming (WAN to LAN) connection even though deny policy