Fortigate: Local-in-policy block Access from internet and others connection

[tungnx59]

Dear All, 

I have a fortigate is facing to internet, it has public IP: a.a.a.a , port : wan 1

I have IPSEC tunnel to another site using WAN 1 port also, and I have Fortimanager manage Fortigate use WAN 1 also.

I want to use Local-in-policy to block unknown Pulbic IP  access to my fortigate via WAN 1 IP Address

My question is: If I apply the local -in-policy on WAN 1, my IPSEC tunnel and Fortimanager can connect to my Fortigate ?

Thanks !

[bkrishnan]

Hello
Please configure a address group that excludes legitimate IPs (IPSec Peer ISP and Fortimanager) and create a Local-in-Policy to block all the other traffic
Please follow the below articles;
https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/201046/blocking-unwanted-ike-negotiatio...

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/363127/local-in-policy

[tungnx59]

it mean, if I only apply Local-in-policy for Trusthost  limit access HTTPS, then my fortigate can not access Fortimanager and IPSEC also , right ?

I need more policy to allow ipsec connection and Fortimanager , right ?

[Atul_S]

Hi,

You may consider creating two local rules. The first local allow rule on the top where you mention your src add for all trusted IP addresses(best to create an address group for this) and allow services like https, ssh, ping, FMG-Access and IPsec. After that, you can create a second local in rule blocking all IP addresses as source.

Thanks,