Policy-in-policy question

[piaakit1210]

Hi All, 

           I have a question, if i create below local in policy, will it restrict our user to connect VPN from remote network or any internet impact ? this policy is only prevent internet traffic from being able to get to your management services, correct ? Thanks 

> config firewall local-in-policy
> edit 100
> set intf “wan1”
> set srcaddr “all”
> set dstaddr “all”
> set service “ALL”
> set schedule “always”
> set action deny
> next
> end

Piaakit  

[Toshi_Esumi]

Why is "set match-vip enable" not available on local-in policies while available on regular policies? Is it too difficult to implement or already has a plan in the near future? I would assume the DEV side has been realizing if it's needed in policies, it's also needed in local-in policies.

Toshi

[kkhushdeep]

Hello,

If you want to restrict access for the vpn by using local-in-policy please check the below configuration example.

Configure the policy to allow traffic from the specific source addresses.

config firewall local-in-policy

edit 0

set intf "WAN" <----- Will be the WAN interface.

set srcaddr "G - ALL PRIVATE ADDRESS RANGES" "GEO-IP Canada" "GEO-IP US" <----- Specify here all sources needed to have access to the SSL-VPN.

set dstaddr "FGT_PUBLIC_IP" <----- Will be the address object for the WAN IP address.

set action accept <----- Action must be 'accept'.

set service "SSLVPN port"

set schedule "always"

next

end

Configure the policy to deny traffic from other source addresses.

config firewall local-in-policy

edit 0

set intf "WAN"

set srcaddr "all" <----- Will be the rest addresses that are not included in the allow policy.

set dstaddr "FGT_PUBLIC_IP"

set service "SSLVPN"

set schedule "always"

next

end

For more details please check the link below:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-Allowing-access-to-the-FortiGa...

Regards,
Khushdeep