I created firewall policy that blocking list of IP addresses using threat feeds but that policy not blocking same IP addresses of accessing firewall itself through public IP and always they try to login.
How I can prevent these list of IP addresses of accessing firewall ?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
That can be done through local-in policy, from CLI.
Apply policy as below:
Create the Local in Policy to restrict access only to the predefined group on management interface (here: port1):
config firewall local-in-policy
edit 1
set intf port1
set srcaddr "MGMT_IPs"
set dstaddr "all"
set action accept
set service HTTPS HTTP
set schedule "always"
set status enable
next
edit 2
set intf "any"
set srcaddr "all"
set dstaddr "all"
set action deny
set service HTTPS HTTP
set schedule "always"
set status enable
end
If using non default ports, create appropriate service object for GUI administrative access:
config firewall service custom
edit GUI_HTTPS
set tcp-portrange <admin-sport>
next
edit GUI_HTTP
set tcp-portrange <admin-port>
end
Use these objects instead of "HTTPS HTTP "in the local-in policy 1 and 2 below.
brother Isamt,
I'm not able to do same local policy because I'm connecting to this firewall using SD-WAN interfaces and within these WAN interfaces there shared internet which not specifying the public IP for that reason I'm not able to use your custom configuration.
Please don't use the "any" interface! You know which interface is connected to the WAN, use the specific port.
The side-effect of using the "any" interface (which must be enabled specifically first) is that you lose the 'interface pair view' in the policy table. And life get's a lot more difficult when debugging.
You are right while I'm connected by public IP it will be difficult to change port while I tried to enable HTTP and I change port number but I wasn't able to access it for that reason I need know how I can disable access to firewall from list of IP's.
You should be able to do what you want using the config firewall local-in-policy
If you enter set int ? you will get a list of all available interfaces that the policy can be applied to. If you just want to block access from a set of IP's then create a group and add the IP's to deny in there.
Then config policy to deny anything in the group and allow what you do want etc.
Oh and you do need to specify the interface so in my example edit 2 should reference port1 as well so code allows traffic to port1 for anything in the MGMT_IPs group and denies all other traffic going to port1 using ports HTTP, HTTPS
How about configuring trusted hosts?
This Below link tells you how to configure local in policy:
https://docs.fortinet.com/document/fortigate/6.2.13/cookbook/363127/local-in-policies
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Filter-ingress-traffic-going-to-the-FortiG...
A few things I could recommend:
1 Disable any protocol access from your WAN port that's not needed
2. Change the default port numbers
3. Use 2-factor authentication for all the admin logins (the FortiGate comes with two free mobile tokens)
4. If you know the IP address that you'll be connecting from for the admin access, then add these to the trusted hosts (configured under each administrator account)= Already done
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
227 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.