Public Ip Firewall Access Blocked but Internally Allow

[sadil5102]

I have disabled my Fortinet Firewall's public IP to be accessed from outside the network. I want to allow the public firewall IP to be accessed from the internal network.

[pminarik]

For administrative access (admin GUI, SSH, etc.):

1, Enable the protocol on the WAN interface

2, Block the access via WAN with a local-in policy (use WAN as the ingress interface)

3, Configure a LAN->WAN policy (required for local-in that "goes across interfaces")

For VIP/etc. (=forwarded traffic): Simply enable the firewall policy with the VIP/IP pool, ensuring that only the relevant source-interfaces (LAN) are allowed.

[AEK]

Do you mean you want to manage your FortiGate from its WAN IP, while only accessible from inside?

If so then you can do it with local-in policy (config firewall local-in-policy), by allowing private IP addresses in the first rule and denying all the rest in the second policy.

https://docs.fortinet.com/document/fortigate/7.2.10/administration-guide/363127