Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
buntha
New Contributor

Cannot Block Country

Dear Everyone,   I have been create policy to block Country, That country is china because of many attack source from china, but after create policy to block i still see traffic from china again. Could you please check this problem for me ?    
4 REPLIES 4
EMES
Contributor

If you are trying to block inbound traffic to your servers then you need to go into the cli and set some commands Config firewall policy Edit <policyid> Set match-vip enable Next End
buntha
New Contributor

Dear sir,

 

Noted with thank, I will try for your solution but could you tell me why we need to add more command to block country ? Because Policy already create to block Geography oh in policy not completed block Geography ?

 

Best Regard,

Buntha 

EMES

The reason is the firewall matches vips first in security policy and without that command set it will never match this policy. It will find your cup policies first.
balcobulls

Emes is exact on this one.  You can have a Geo-location block policy going to destination of ALL, if 

 

set match-vip enable

 

is not enabled, you will see a lot of 0 packets.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors