Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
scerazy
New Contributor III

Geo-lock access to Windows IKEv2 native VPN

Is there a way to geo lock access to Windows IKEv2 native VPN on Fortigate (same as one can do with SSL VPN)?

 

Seb

2 Solutions
ozkanaltas
Valued Contributor III

Hello @scerazy ,

 

According to my research, there is no option to restrict incoming connections to dial-up-only VPNs.

 

You can use local-in-policy for that. But if you configure local-in-policy, that policy affects all ipsec vpn. Because these types of VPNs use the same TCP/UDP ports.

 

If you want to get more information about local-in-policy you can review these articles.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Inbound-Access-from-Specific-Coun...

 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/363127/local-in-policy

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW

View solution in original post

If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
ozkanaltas
Valued Contributor III

Hello @scerazy ,

 

Yes, you can use negate option in local-in-policy. You can do this with the negate setting. The negate option means outside the object you use.

 

For example

 

config firewall local-in-policy
edit 0
set srcaddr-negate enable
end

 

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW

View solution in original post

If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
8 REPLIES 8
ozkanaltas
Valued Contributor III

Hello @scerazy ,

 

According to my research, there is no option to restrict incoming connections to dial-up-only VPNs.

 

You can use local-in-policy for that. But if you configure local-in-policy, that policy affects all ipsec vpn. Because these types of VPNs use the same TCP/UDP ports.

 

If you want to get more information about local-in-policy you can review these articles.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Inbound-Access-from-Specific-Coun...

 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/363127/local-in-policy

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
scerazy
New Contributor III

Would there be an easy way to do the opposite? Block all, but only allow X Y Z ?

 

I still do not see how/why local-in is different than normal rules

 

edit

firewall policy is for traffic going THROUGH the FortiGate.

Local-in is for traffic going TO the FortiGate.

ozkanaltas
Valued Contributor III

Hello @scerazy ,

 

Yes, you can use negate option in local-in-policy. You can do this with the negate setting. The negate option means outside the object you use.

 

For example

 

config firewall local-in-policy
edit 0
set srcaddr-negate enable
end

 

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
scerazy
New Contributor III

Is GUI not capable displaying CLI created rule entry?

I cannot see it (it shows fine in CLI)

hbac

Hi @scerazy,

 

local-in-policy is not configurable on the GUI. Only in the CLI.

 

Regards, 

scerazy
New Contributor III

I did not mean to configure, just to display would be fine (but does not do that either)

It displays other existing bits, but not CLI configured policy

Yurisk

Fortinet do not provide such option, but if you'd like a user Danny created a Javascript bookmarklet that will do it for you: 

https://community.fortinet.com/t5/Support-Forum/Show-custom-local-in-policies-in-FortiGate-WebUI/td-...

 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
scerazy
New Contributor III

Nice, thanks

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors