How to block external IP to avoid connection from it via VPN IPSec
We have FG61E with 6.2.4 build1112(GA)
How to block connection from external IP and deny (restrict) to connect by VPN IPSec from this IP?
I've created following Policy:
config firewall policy
set name "Ban_IPs"
set uuid d193dc82-cd81-51ea-ef15-3efed830df47
set srcintf "WAN"
set dstintf "LAN"
set srcaddr "Ban_IP"
set dstaddr "LAN_7"
set schedule "always"
set service "ALL"
set logtraffic all
and put this policy on top of the list, before policy for VPN IPSec.
But it doesn't work, remote notebook still be able to connect by VPN IPSec from this external IP ("Ban_IP" in policy) to local network ("LAN_7" in policy).
Could someone give me any idea where is an error?
Thanks in advance))
A while ago we implemented IP Address Threat Feeds and put them on DENY firewall rules at a higher precedence than the allow rules for Internet-facing services. This greatly reduced noise in the logs of connections to Internet-facing services, and improved overall security posture as the known IPs scanning for vulnerabilities in systems is getting dropped.
Where we still see noise in the logs is with connections to the FortiGate SSL VPN endpoints, and given there have been vulnerabilities in that in the past (example), I want to keep the known and likely bad IPs away from connecting at all. When searching how to do this, I found this post about using local-in policies, but after looking at it, it appears IP Address Threat Feeds can't be used against those. So how can this be achieved? Alternatively or in addition to that, is there any threat intelligence included with the FortiGuard subscription that can be configured somewhere else to filter this stuff (e.g., on the WAN interfaces)?
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.