Deny management / access from specific sources

[Ahmed]

Hello all 

i received multiple notification e-mails, multiple sources in china, try to access my fortigate via ssh ( Hack ).

how can  i deny these sources from access my UTM

[Carl_Wallmark]

Hi,

You can try with "local-in-policy"

Assuming you have FortioS 5 or above:

1. Create a address object which contains "Geography" and select China as country.

2. Go to CLI and type:

config firewall local-in-policy     edit 0         set intf "wan1"         set srcaddr "China"         set dstaddr "all"                          <- This can be the IPs you want to deny access to         set service "SSH"

        set action deny         set schedule "always"     next end