Access through IP should not be allowed for Firewall management only FQDN allowed.

[sasad]

Dear

We have Fortigate FG200E firewall, we need to access the Firewall through FQDN for that we have added the A records in our local and public DNS.

But now we need to stop the access direct from public IP, and the administrators must use the FQDN to access the Firewall management page.

Can anyone please help that how can I achieve this?

[AEK]

Hello Sasad

Since this is a field of http request, as far as I know this can be done if you have a WAF between clients and FG.

On the other hand may I ask why such requirement?

[sasad]

We need it as we have multiple sites and our admins access them frequently and our certificate is on FQDN this is not support IP address, so the communication will not be encrypted in this case.

[AEK]

You still can issue one single certificate for both FQDN and IP address, so your communication will be secure if you use either FQDN or IP.

[sasad]

I tried to generate the certificate from Fortigate with IP address and domain name but still it is showing certificate error. While the IP address is available in the Subject Alternate name.

[sasad]

Also we have more than 30 firewalls with different public IPs, therefore we have generated the certificate *.mydomain.com and using it at each site.

[AEK]

Whe you add the IP in "Subject Alternative Name", you have to specify that it is a IP SAN. Like this:

IP:x.x.x.x

[sasad]

I tried this way but it showing invalid IP.

[AEK]

On your screenshot you are generating new certificates. That's not what you need. You need to generate a Certificate Signing Request (CSR) for your WebUI.

[AEK · Accepted solution]

Please check this.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Issue-SSL-certificates-with-Microsoft/ta-p...