Hello all.
Need a help with configuration local-in-policy to blocking IPsec from not known sources.
I created policy like this:
config firewall local-in-policy
edit 1
set intf "wan1"
set srcaddr "s2s_name"
set dstaddr "all"
set action accept
set service "IKE" "ESP"
set schedule "always"
set status enable
next
edit 2
set intf "wan1"
set srcaddr "all"
set dstaddr "all"
set action deny
set service "IKE" "ESP"
set schedule "always"
set status enable
next
end
But still continue to get a lot alerts like this:
date=2023-08-28 time=04:56:59 devname=FortiGate devid=FG200EXXXXXXXXX eventtime=1693187818206746689 tz="+0300" logid="0101037131" type="event" subtype="vpn" level="error" vd="root" logdesc="IPsec ESP" msg="IPsec ESP" action="error" remip=80.82.XX.XXX locip="185.MY IP ADD" remport=4500 locport=500 outintf="wan1" cookies="N/A" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="esp_error" error_num="Received ESP packet with unknown SPI." spi="30303030" seq="30303030"
Thanks!
Aleksei
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
remport=4500, usually means NAT-T in action. Can you check if the ESP packet is encapsulated in UDP4500 ? If that is the case, may the the local-in policy need to call/specify UDP4500 also.
Hi,thank you for answer.
ESP - Protocol Type = IP, Protocol Number = 50
IKE - UDP/500 UDP/4500
Created on 08-28-2023 05:37 AM Edited on 08-28-2023 05:41 AM
I checked the bug ID mentioned in below post, unfortunately this looks like a limitation for now. Actually this drop (SPI mismatch) happens before the local-in-policy check, so technically its not a bug it is working as expected.
https://community.fortinet.com/t5/Support-Forum/ESP-not-being-blocked-by-local-in-policy-for-existin...
Great!
It is about 5.6.5 FortiGates. Do you know about version v7.0.+ ?
Yeah, its still same. The below article explains the behavior.
Thank you.
:(
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1697 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.