Technical Tip: Local-in policy using ISDB as a source address

[syordanov]

Description	This article describes how to use ISDB objects as a source IP address for local-in policy.
Scope	FortiGate v7.4.4+.
Solution	Local-in policies use ISDB as a source address. Local-in policies are used to control the traffic destined for FortiGate interfaces. For example: HTTP/HTTPS or SSH traffic can be allowed or denied by local-in policies. Another useful approach is to restrict the access to VPN/remote VPN access based on geographic type IP addresses. In FortiOS versions up to 7.4.4, source IP addresses can be used only for IP addresses, address groups, or geographic type addresses. FortiOS 7.4.4 has introduced a new feature that allows ISDB objects to be used as a source. To enable using 'ISDB' objects as source addresses, it is mandatory to enable the 'internet-service-src': Configuration: config firewall local-in-policy     edit 2         set intf "port1"         set dstaddr "all"         set internet-service-src enable         set service "ALL"         set schedule "always"     next end Once the option ' internet-service-src' is enabled, the admin can set different ISDB objects as a source IP by using the command 'set internet-service-src-name': config firewall local-in-policy     edit 2         set intf "port1"         set dstaddr "all"         set internet-service-src enable         set internet-service-src-name "Google-Gmail" "Fortinet-Other" "Malicious-Malicious.Server" <--         set service "ALL"         set schedule "always"     next end Note: As of FortiOS v7.6.1, a new default local-in-policy has been added with internet service source enabled for Malicious-Malicious.Server, Tor-Exit.Node, and Tor-Relay.Node. This policy is designed to utilize these 3 ISDB sources to identify known malicious threat actors and prevent them from accessing any interface on the FortiGate on any service and port. Note: As of FortiOS v7.6.0, the Local-in-Policy can now be also configured in the GUI. Refer to Technical Tip: Creating a Local-In policy (IPv4 and IPv6) on the GUI. By default, the action of the local-in rules is 'deny'. If the administrator wants to see logs for the blocking results of the local-in policy, the following change needs to be implemented under log settings: config log setting     set local-in-deny-unicast enable end