Delete Local-in Policy

[tio3udes]

Hello Everyone.

So, I'm managing a client's Azure deployed fortigate, which has some local-in policies i'd like to get rid off, so it won't accept connections on a specific interface.

The problem is that the local in policies are not editable via gui, and via cli they don't even show. I can create new ones and all but, I would really like to simply delete the ones i don't need.

Even on a show full-config output the local in policies dont appear.

Anyone know how to delete these policies?

#fortigate

[pminarik · Accepted solution]

Then it would mean that in this case it cannot be removed at all.

Anyway, if you don't have any IPsec configured, that means that there's nothing listening on ports 500/4500, so any incoming packet destined for these ports will be dropped regardless.

[pminarik]

You can only delete/modify local-in policies that are visible in "config firewall local-in-policy". Anything else that isn't listed there but is visible in GUI is controlled automatically by the system, and you cannot manually remove them. (at best you can override-those with new local-in policies with deny action)

[tio3udes]

Thank's for the reply, even thought it confirmed my fears hehe!

So, on the same subjetc, a different question. Since these are controlled automatically by the system i understand that if I create a IPSEC vpn, udp 500/4500 are enabled on the ipsec listening interface, is that right? If so, on the same line of thought, if I delete the ipsec configuration, should the local-in policy be deleted too?

I ask, because I tried to apply this stratagy to get rid off the policies, and it didn't work.

[pminarik · Accepted solution]

Then it would mean that in this case it cannot be removed at all.

Anyway, if you don't have any IPsec configured, that means that there's nothing listening on ports 500/4500, so any incoming packet destined for these ports will be dropped regardless.

[Yurisk · Accepted solution]

The reality confirms what @tio3udes says, see the screenshot - bottom row of it, this is a screenshot of an absolutely new VM FGT install, no IPsec whatsoever configured, nor site-to-site, nor IPSec client-to-site, and still 500 and 4500 are already open :)

https://yurisk.info/2020/06/07/fortigate-local-in-policy/ 

EDIT: For preciseness sake, yes, you are correct -  the incoming packets will be dropped as no valid IPsec policies are configured, but still, the Local-in policy does allow them, even though, in the nmap scan they will appear as "closed". 

[tio3udes]

Great article bro. Came accross it when researching this issue!

[tio3udes]

So, the situation is that people are running port scans, hitting this firewall's interface, the logs are showing an accepted connection from a foreign host and the csirt team is coming to me for a sollution.

The only way to solve this would be to create blocking policies?

[pminarik]

Which ports?

UDP can't really be scanned, and it you don't have any IPsec tunnels, there's nothing to reply to even well-crafted attempts to find IPsec VPN servers, so for all intents and purposes, that's a closed UDP/500/4500.

So this will depend on which ports you're talking about. And as I suggested earlier, if you create an explicit deny policy for the desired port, that should override an existing hard-coded setting.

[Yurisk]

Interesting question and observation. From my experience, shutting down some service not necessary closes its ports on the Fortigate. Only that I never had the incentive/time to investigate this further :). Following to get updates.