How to block external IP to avoid connection from it via VPN IPSec

[Nickway]

Hello All, We have FG61E with 6.2.4 build1112(GA) How to block connection from external IP and deny (restrict) to connect by VPN IPSec from this IP? I've created following Policy:

config firewall policy edit 15 set name "Ban_IPs" set uuid d193dc82-cd81-51ea-ef15-3efed830df47 set srcintf "WAN" set dstintf "LAN" set srcaddr "Ban_IP" set dstaddr "LAN_7" set schedule "always" set service "ALL" set logtraffic all next end

and put this policy on top of the list, before policy for VPN IPSec. But it doesn't work, remote notebook still be able to connect by VPN IPSec from this external IP ("Ban_IP" in policy) to local network ("LAN_7" in policy). Could someone give me any idea where is an error? Thanks in advance))

[Yurisk]

Hi, you cannot block IPSec VPN traffic destined to the Fortigate IP itself with usual Security Rules - they only manage traffic PASSING the Fortigate from one interface to another.   

To achieve that you need to use Local-in policy (viewable in GUI but editable in CLI only). 

So your policy would look like (this will block ALL access from Ban_IP (only) to Fortigate, IPsec VPN, SSL VPN, Admin GUi etc. If you want to block just IPsec, set service accordingly):

config firewall local-in-policy
 edit 0
 set intf "WAN"
 set srcaddr "Ban_IP"
 set dstaddr "all"
 set service "ALL"
 set schedule "always"

set action deny
next
end

More details with reference to Fortinet docs you can read here: https://yurisk.info/2020/06/07/fortigate-local-in-policy/

[Nickway]

Hi Yuri

Thank you VERY much for your quick response and detail advice, now it is working!)) I'll read more carefully docs which you have pointed Best regards

[veechee]

A while ago we implemented IP Address Threat Feeds and put them on DENY firewall rules at a higher precedence than the allow rules for Internet-facing services. This greatly reduced noise in the logs of connections to Internet-facing services, and improved overall security posture as the known IPs scanning for vulnerabilities in systems is getting dropped.

Where we still see noise in the logs is with connections to the FortiGate SSL VPN endpoints, and given there have been vulnerabilities in that in the past (example), I want to keep the known and likely bad IPs away from connecting at all. When searching how to do this, I found this post about using local-in policies, but after looking at it, it appears IP Address Threat Feeds can't be used against those. So how can this be achieved? Alternatively or in addition to that, is there any threat intelligence included with the FortiGuard subscription that can be configured somewhere else to filter this stuff (e.g., on the WAN interfaces)?

[maredcz]

... maybe you should do:

config firewall local-in-policy

Martin

[pavankr5]

Hello, 

Check this article on How to block unauthorized connections to IPsec VPN 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-unauthorized-connections-to-I...

Thanks,

Pavan