Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
FortiMax_it
Contributor

Local-in-policy and log

Hi, I have a Fortigate 60E firmware 7.4.1
I have a public subnet that very often tries to connect via IPSEC VPN to the firewall. I therefore created a local-in-policy to deny the connection to this subnet, but I continue to see the logs and I also receive emails from an automation that notifies me of unsuccessful VPN connections.
Shouldn't the local-in-policy block the source connection so it doesn't even create the log?
The firewall navigates with a public IP directly on its WAN.

 

 

 edit "Attempt_ipsec_167.0.0.0"
        set uuid 006d9cf8-500d-51ee-cdb6-363058ded725
        set subnet 167.0.0.0 255.0.0.0
config firewall local-in-policy
    edit 1
        set uuid d69d2fdc-500d-51ee-9cb8-ff27447660f2
        set intf "WAN-Fibra"
        set srcaddr "Attempt_ipsec_167.0.0.0"
        set dstaddr "all"
        set service "IKE" "ALL_ICMP" "VPN_SSL_9443"
        set schedule "always"

 

 

 
IKE.jpg

 

log__.jpg

14 REPLIES 14
anignan
Staff
Staff

Hi @FortiMax_it 

Can you confirm that your IKE service is UDP 500? Yes local-in should block it

Abdel

FortiMax_it

Hi Abdel, thanks for the reply but what you tell me I think is more of a workaround because if I have a local-in-policy that blocks IPSEC traffic, why is the log created in the VPN events section?
If traffic is blocked on the WAN interface it must not be processed by the CPU. As you can see it is as if the package has been processed. It should be discarded directly.

 

event.png

anignan

Exactly theoretically it should not hit the ike daemon.. Let me try to replicate this in my lab

 

Abdel

anignan
Staff
Staff

HI @FortiMax_it 

 

This seems to be an expected behavior because this is not a proposal received from remote peer but an ESP packet with incorrect SPI... This packet is being dropped before local-in-policy by the kernel and iked logs it..

 

Is you FortiGate support acl? check with the command show router access-list

 

Abdel

FortiMax_it

Hi,
does it support ACLs, yes.
ACL.png

anignan

Hi @FortiMax_it 

 

Try to use ACL this may help in your case..

 

Abdel

FortiMax_it

I tried to create it, I've almost never used them, I hope I did it right (I'm not sure whether I should put deny or permit in the access list as the route map is already in deny) :D
I'll keep you updated

 

route.png

anignan

Hi @FortiMax_it 

 

No sorry my bad this should be place under config firewall acl...

 

REF: https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/898126/access-control-lists

 

Abdel

 

FortiMax_it

Not supported :(

 

config firewall acl

command parse error before 'acl'
Command fail. Return code 1

Let's see if the access list I created still works in some way... I'll keep you updated

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors