Restrict incoming traffic to email archive server

[yeowkm99]

We want to restrict incoming traffic from external to our email archive server.

We are currently using M365 email service.

currently we have on policy from WAN to LAN, all to archive server, services - https, ssh, ntp, dns, tcp8000.

how can we restrict the incoming traffic ?

[rahul_p1]

Hi,

Please create a firewall policy from wan to lan to deny traffic on the basis of ISDB or server IP:- 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-Deny-Policy-using-Internet-Serv...

[yeowkm99]

we want to allow only microsoft services but it seems if I use Internet service group, some services are for destination only and cannot be used as source

[bkrishnan]

Hi 
The below doc might help you;
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LA...