Geo-lock access to Windows IKEv2 native VPN

[scerazy]

Is there a way to geo lock access to Windows IKEv2 native VPN on Fortigate (same as one can do with SSL VPN)?

Seb

[ozkanaltas · Accepted solution]

Hello @scerazy ,

According to my research, there is no option to restrict incoming connections to dial-up-only VPNs.

You can use local-in-policy for that. But if you configure local-in-policy, that policy affects all ipsec vpn. Because these types of VPNs use the same TCP/UDP ports.

If you want to get more information about local-in-policy you can review these articles.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Inbound-Access-from-Specific-Coun...

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/363127/local-in-policy

[ozkanaltas · Accepted solution]

Hello @scerazy ,

According to my research, there is no option to restrict incoming connections to dial-up-only VPNs.

You can use local-in-policy for that. But if you configure local-in-policy, that policy affects all ipsec vpn. Because these types of VPNs use the same TCP/UDP ports.

If you want to get more information about local-in-policy you can review these articles.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Inbound-Access-from-Specific-Coun...

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/363127/local-in-policy

[scerazy]

Would there be an easy way to do the opposite? Block all, but only allow X Y Z ?

I still do not see how/why local-in is different than normal rules

edit

firewall policy is for traffic going THROUGH the FortiGate.

Local-in is for traffic going TO the FortiGate.

[ozkanaltas · Accepted solution]

Hello @scerazy ,

Yes, you can use negate option in local-in-policy. You can do this with the negate setting. The negate option means outside the object you use.

For example

config firewall local-in-policy
edit 0
set srcaddr-negate enable
end

[scerazy]

Is GUI not capable displaying CLI created rule entry?

I cannot see it (it shows fine in CLI)

[hbac]

Hi @scerazy,

local-in-policy is not configurable on the GUI. Only in the CLI.

Regards, 

[scerazy]

I did not mean to configure, just to display would be fine (but does not do that either)

It displays other existing bits, but not CLI configured policy

[Yurisk]

Fortinet do not provide such option, but if you'd like a user Danny created a Javascript bookmarklet that will do it for you: 

https://community.fortinet.com/t5/Support-Forum/Show-custom-local-in-policies-in-FortiGate-WebUI/td-...

[scerazy]

Nice, thanks