Hello All, We have FG61E with 6.2.4 build1112(GA) How to block connection from external IP and deny (restrict) to connect by VPN IPSec from this IP? I've created following Policy:
config firewall policy edit 15 set name "Ban_IPs" set uuid d193dc82-cd81-51ea-ef15-3efed830df47 set srcintf "WAN" set dstintf "LAN" set srcaddr "Ban_IP" set dstaddr "LAN_7" set schedule "always" set service "ALL" set logtraffic all next end
and put this policy on top of the list, before policy for VPN IPSec. But it doesn't work, remote notebook still be able to connect by VPN IPSec from this external IP ("Ban_IP" in policy) to local network ("LAN_7" in policy). Could someone give me any idea where is an error? Thanks in advance))
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi, you cannot block IPSec VPN traffic destined to the Fortigate IP itself with usual Security Rules - they only manage traffic PASSING the Fortigate from one interface to another.
To achieve that you need to use Local-in policy (viewable in GUI but editable in CLI only).
So your policy would look like (this will block ALL access from Ban_IP (only) to Fortigate, IPsec VPN, SSL VPN, Admin GUi etc. If you want to block just IPsec, set service accordingly):
config firewall local-in-policy
edit 0
set intf "WAN"
set srcaddr "Ban_IP"
set dstaddr "all"
set service "ALL"
set schedule "always"
set action deny
next
end
More details with reference to Fortinet docs you can read here: https://yurisk.info/2020/06/07/fortigate-local-in-policy/
Hi Yuri
Thank you VERY much for your quick response and detail advice, now it is working!)) I'll read more carefully docs which you have pointed Best regards
A while ago we implemented IP Address Threat Feeds and put them on DENY firewall rules at a higher precedence than the allow rules for Internet-facing services. This greatly reduced noise in the logs of connections to Internet-facing services, and improved overall security posture as the known IPs scanning for vulnerabilities in systems is getting dropped.
Where we still see noise in the logs is with connections to the FortiGate SSL VPN endpoints, and given there have been vulnerabilities in that in the past (example), I want to keep the known and likely bad IPs away from connecting at all. When searching how to do this, I found this post about using local-in policies, but after looking at it, it appears IP Address Threat Feeds can't be used against those. So how can this be achieved? Alternatively or in addition to that, is there any threat intelligence included with the FortiGuard subscription that can be configured somewhere else to filter this stuff (e.g., on the WAN interfaces)?
... maybe you should do:
config firewall local-in-policy
Martin
Hello,
Check this article on How to block unauthorized connections to IPsec VPN
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-unauthorized-connections-to-I...
Thanks,
Pavan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1645 | |
1070 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.