How to Block Multiple Countries?

[smccarthy945]

I am trying to block a large list of countries by creating an address group and adding the countries into the group via the geography type.  The problem I am running into is that I have to create a new entry for every single country I want to block in the web interface and it will be incredibly time consuming to sit for hours to add every single country into the address group. Is there a faster way - maybe via the command line - that I can add countries into the address group? 

Since we only do business in the US, I want to block a good portion of other countries in my rule sets. Thanks in advance. 

Scott

[smccarthy945]

One other question. Can I create an Access Control List on the Internet port and deny the country list on there? 

[SCSIraidGURU]

Name: Geographical Blocking Incoming: Wan-Load_balance (both WAN1 and WAN2) Outgoing: Any Source: Blocked_Countries (Address group) Destination: all Schedule: Always Services: All Action Deny Blocks 120,000+ a day.

[smccarthy945]

Thank you!

[smccarthy945]

Just so you know, I also was able to add it as a ACL in the IP4 Policies and it dropped a bunch of packets as well so it seems you can do it both ways. Thanks for the help on this. 

[SCSIraidGURU]

I asked Cisco to do it.  They would not. 

Fortinet gave me Two WAN port link balanced and Geographical based blocking.  I just block all IP traffic from those countries, 120,000+ a day.

[ede_pfau]

Specify this source to block all countries: ALL

I can't see why the explicit allow and implicit deny would not work - as a principle, anything that is not explicitely allowed is denied. No need to gather 198 country address ranges in an address group...

Policy order is important:

1- allow these few countries: from WAN/allowed_countries to LAN/my_LAN, ACCEPT

2- no further policies following!

If you need to you may enable logging of denied traffic, just to be sure it works. Then, cancel logging.

[SCSIraidGURU]

It is a short coming on the Fortinet IOS.   It would be nice if you could do just an allow of the US and then a deny of every other country.   You can't do it without listing all of them first in a group.  Geography is a address sub-object.  You can have one to one in this object.   Only an address-group can do many to one object.   In these cases, you just do implicit deny only. 

[MikePruett]

Create a policy stating that only approved countries can come in.

Or, do what some of my customers have done and have an address group called BLOCKED_COUNTRIES and add each one to that group.

Make that policy the top one and you are on your way.

[SCSIraidGURU]

My Cisco ASA would put a country flag next to an IP based on ICANN list.   I tried doing allows only.  All it did was increment the log numbers for the policy when one was hit.   I found Russian IPs in the logs that did get through the allow only.   Only rule that worked perfectly was deny with blocked countries.   It did not block the other addresses in Fortinet.  I wish Fortinet could fix this or add continent blocking for Asia, Africa, South America. 

[Anand_Prabhu]

I noticed that you were looking for CLI commands but none of the replies quoted it. Here are the CLI commands to reduce your time creating bunch of address objects.

Create Address Objects for each Country

FG#config firewall address (address) # edit Japan new entry ‘Japan’ added (Japan)# set type geography (Japan)# set country JP (Japan)# set associated-interface wan1 (Japan)# next (address) # edit China new entry ‘China’ added (Japan)# set type geography (Japan)# set country CN (Japan)# set associated-interface wan1 (Japan)# next (address)# end

“set associated-interface” command is optional and if not configured, then FortiGate considers “any” interface.

Create Address Group

FG# config firewall addrgrp (addrgrp)# edit CountryGroup (CountryGroup)# set member Japan China (CountryGroup)# next (CountryGroup)# end

You find here the full list of FortiGate Country Codes - http://itadminguide.com/f...ns-using-cli-commands/