Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Cannot Block Country

Dear Everyone,   I have been create policy to block Country, That country is china because of many attack source from china, but after create policy to block i still see traffic from china again. Could you please check this problem for me ?    

If you are trying to block inbound traffic to your servers then you need to go into the cli and set some commands Config firewall policy Edit <policyid> Set match-vip enable Next End
New Contributor

Dear sir,


Noted with thank, I will try for your solution but could you tell me why we need to add more command to block country ? Because Policy already create to block Geography oh in policy not completed block Geography ?


Best Regard,



The reason is the firewall matches vips first in security policy and without that command set it will never match this policy. It will find your cup policies first.

Emes is exact on this one.  You can have a Geo-location block policy going to destination of ALL, if 


set match-vip enable


is not enabled, you will see a lot of 0 packets.

Top Kudoed Authors