Fortigate 200D - v5.0 - Disable VPN

[mdmd]

Hi 

We are running a couple of Fortigate 200Ds in a HA active passive cluster.

When i go to Features --> VPN and disable, it doesn't actually disable it, the web front end is still visible and users can still login.

Is this a bug, disabling or enabling doesnt seem to do anything, apart from when the VPN is disabled, the menu at the side bar is gone, but it is still active

Any help?

Thanks

Mike

[mdmd]

Figured it out with local- in policies, 

Doing this for PCI DSS compliance, only thing flagging now is port 8009 on the wan interface, any way to disable that just for wan?

[mdmd]

seen 8009 in the local in polcies in "other" :

-TCPwan18009

Accept

How would i disable this?

[mdmd]

So im trying :

config firewall local-in-policy
     edit 1
         set intf " wan1" 
         set srcaddr " all" 
         set dstaddr " all" 
         set service " EndpointDownload" 
         set schedule " always" 
     next
end

And all i get is :

node_check_object fail! for intf  wan1

value parse error before ' wan1'

Command fail. Return code -651

after running : 

set intf " wan1" 

[emnoc]

Will don't apply the interface. It's not required.

Ken

[mdmd]

Thanks Ken...

But I only want to apply it to the wan1 interface (external facing) as its open by default?

[ede_pfau]

A-hem...you miss-spelled the WAN port's name - you wrote " wan" but it's "wan". Too generous with spaces...

And to clarify your initial problem: configuring some feature out of the GUI doesn't mean the feature itself is disabled. The "feature select" thing is just to allow you to customize the WebGUI. All features are still intact and active if you have configured them. (This topic seems to pop up more often recently.)

SSL VPN is one of the features which are partly preconfigured. You've found one way to block access to it via local-in policies. Be aware that you block exactly the port which you configure to be the access port for SSL VPN (in Config > Admin > Settings).

(though I wasn't aware that the SSLVPN daemon would be started even without a SSLVPN policy..have to check that)

[mdmd]

Hi Ede,

Thank you for your response

I realised almost as soon as I did that on the spaces, I created a wan2 one no problem now, but still when I go to do a wan1 one :

Does this matter that the wan1 has the alias "untrust" ? Although cant get either to work

FG200D4613803399 # config firewall local-in-policy

 

FG200D4613803399 (local-in-policy) # edit 2

new entry '2' added

 

FG200D4613803399 (2) # set intf "wan1"

node_check_object fail! for intf wan1

 

value parse error before 'wan1'

Command fail. Return code -651

 

FG200D4613803399 (2) #  

[ede_pfau]

What do you get when you type "set intf ?" - should produce a list of available interfaces (physical and virtual).

[ede_pfau]

gate (local-in-policy) # sh
config firewall local-in-policy
end

gate (local-in-policy) # ed 1
new entry '1' added

gate (1) # set intf bla
node_check_object fail! for intf bla

value parse error before 'bla'
Command fail. Return code -651