FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes an issue when using a local-in policy to block a certain region address but not working as expected.
Scope
FortiGate.
Solution
Refer to the local-in policy configure below ;
config firewall local-in-policy edit 1 set uuid c1326b62-ab02-51ee-ab9b-3751cf89892a set intf "port1" set srcaddr "Country RU" set dstaddr "all" set service "ALL" set schedule "always" next
Suppose the blocking should work, but due to differences in registration and physical address location, the access still working.
Example:
diagnose firewall ipgeo ip2country 62.233.39.35 62.233.39.35 is in country: NL, registered country is RU, is not anycast ip.
The registration address is Russia but the physical location is Netherlands. The respective address (Netherlands) also needs to be added to the source address since the GeoIP-match. It was only supported on normal firewall policy, not local-in-policy.
