100F (6.4.13)-SSL VPN Allow access only from USA hosts not working?

[MacFort]

Hello 

I have that setting enabled on my ssl vpn and I though by doing that I would not see any connection attempts from other countries.  However I have been seeing for example this type of alert (IP in Kiev) <See Below>

Which seems to indicate an attempt to negotiate a session/connection from an address in Kiev - i thought such attempts would simply be dropped.

Can someone explain to me why this is?

thank you all

Message meets Alert condition

date=2023-06-26 time=09:26:35 devname=MY-100F devid=FG100FTKBlah eventtime=1687785995930100828 tz="-0400" logid="0101037128" type="event" subtype="vpn" level="error" vd="root" logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action="negotiate" remip=109.207.200.44 locip=XXX.XXX.XXX.XXX remport=500 locport=500 outintf="wan1" cookies="55656d6764527746/0000000000000000" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="failure" init="remote" exch="SA_INIT" dir="inbound" role="responder" result="ERROR" version="IKEv2" 

[Toshi_Esumi]

Did you follow below Geo Blocking method?
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-SSL-VPN-connectivity-from-cert...

Toshi

[MacFort]

I have in the GUI/SSL VPN Settings - Restrict Access: /Limit Access to specific hosts / USA

thanks

[Toshi_Esumi]

That should work for SSLVPN. But I noticed the log you posted is NOT for an SSL VPN attempt but for an IPsec VPN attempt. To block IPSec vpn attempts, you need to apply the same geo blocking to local-in policy. It's available only in CLI. One of contributors @Yurisk's public post includes geo-blocking with local-in policy.
https://yurisk.info/2022/07/04/fortigate-local-in-policy-configuration-examples-for-vpn-ipsec-vpn-ss...

Toshi

[MacFort]

Thank you so much Toshi 

I did not realize that

Thanks