Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
tio3udes
New Contributor III

Delete Local-in Policy

Hello Everyone.

 

So, I'm managing a client's Azure deployed fortigate, which has some local-in policies i'd like to get rid off, so it won't accept connections on a specific interface.

 

The problem is that the local in policies are not editable via gui, and via cli they don't even show. I can create new ones and all but, I would really like to simply delete the ones i don't need.

 

Even on a show full-config output the local in policies dont appear.

 

Anyone know how to delete these policies?

 

#fortigate

ti03udes
2 Solutions
pminarik

Then it would mean that in this case it cannot be removed at all.

 

Anyway, if you don't have any IPsec configured, that means that there's nothing listening on ports 500/4500, so any incoming packet destined for these ports will be dropped regardless.

[ test signature, please ignore ]

View solution in original post

Yurisk
Valued Contributor

The reality confirms what @tio3udes says, see the screenshot - bottom row of it, this is a screenshot of an absolutely new VM FGT install, no IPsec whatsoever configured, nor site-to-site, nor IPSec client-to-site, and still 500 and 4500 are already open :)

https://yurisk.info/2020/06/07/fortigate-local-in-policy/ 

 

EDIT: For preciseness sake, yes, you are correct -  the incoming packets will be dropped as no valid IPsec policies are configured, but still, the Local-in policy does allow them, even though, in the nmap scan they will appear as "closed". 

Yuri
https://yurisk.info/ blog: All things Fortinet, no ads.


All opinions are mine only.

View solution in original post

8 REPLIES 8
pminarik
Staff
Staff

You can only delete/modify local-in policies that are visible in "config firewall local-in-policy". Anything else that isn't listed there but is visible in GUI is controlled automatically by the system, and you cannot manually remove them. (at best you can override-those with new local-in policies with deny action)

[ test signature, please ignore ]
tio3udes
New Contributor III

Thank's for the reply, even thought it confirmed my fears hehe!

 

So, on the same subjetc, a different question. Since these are controlled automatically by the system i understand that if I create a IPSEC vpn, udp 500/4500 are enabled on the ipsec listening interface, is that right? If so, on the same line of thought, if I delete the ipsec configuration, should the local-in policy be deleted too?

 

I ask, because I tried to apply this stratagy to get rid off the policies, and it didn't work.

ti03udes
pminarik

Then it would mean that in this case it cannot be removed at all.

 

Anyway, if you don't have any IPsec configured, that means that there's nothing listening on ports 500/4500, so any incoming packet destined for these ports will be dropped regardless.

[ test signature, please ignore ]
Yurisk
Valued Contributor

The reality confirms what @tio3udes says, see the screenshot - bottom row of it, this is a screenshot of an absolutely new VM FGT install, no IPsec whatsoever configured, nor site-to-site, nor IPSec client-to-site, and still 500 and 4500 are already open :)

https://yurisk.info/2020/06/07/fortigate-local-in-policy/ 

 

EDIT: For preciseness sake, yes, you are correct -  the incoming packets will be dropped as no valid IPsec policies are configured, but still, the Local-in policy does allow them, even though, in the nmap scan they will appear as "closed". 

Yuri
https://yurisk.info/ blog: All things Fortinet, no ads.


All opinions are mine only.
tio3udes
New Contributor III

Great article bro. Came accross it when researching this issue!

ti03udes
tio3udes
New Contributor III

So, the situation is that people are running port scans, hitting this firewall's interface, the logs are showing an accepted connection from a foreign host and the csirt team is coming to me for a sollution.

 

The only way to solve this would be to create blocking policies?

ti03udes
pminarik

Which ports?

UDP can't really be scanned, and it you don't have any IPsec tunnels, there's nothing to reply to even well-crafted attempts to find IPsec VPN servers, so for all intents and purposes, that's a closed UDP/500/4500.

 

So this will depend on which ports you're talking about. And as I suggested earlier, if you create an explicit deny policy for the desired port, that should override an existing hard-coded setting.

[ test signature, please ignore ]
Yurisk
Valued Contributor

Interesting question and observation. From my experience, shutting down some service not necessary closes its ports on the Fortigate. Only that I never had the incentive/time to investigate this further :). Following to get updates.

Yuri
https://yurisk.info/ blog: All things Fortinet, no ads.


All opinions are mine only.