Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
DT3
New Contributor

SSL VPN Country Restriction

Hi,

 

I have recently tried to restrict our SSL VPN to one specific country. I have created the Geography Object for the country, added it under SSL-VPN Settings, limit access to specific hosts.

Under the SSL-VPN tunnel interface policy the source for IPs was all, so I have changed it to the object I created for the country as I understand the Country has to be set in both places.

The problem I am having is that users can connect, but once connected they cannot access anything. If I take the Country out of the SSL-VPN tunnel interface policy and change back to all it works fine.

As far as I can see I have implemted as recommended so unsure of where to go next. I have tried one two different VPN devices both with public IPs in the country I created.

1 Solution
pminarik

Yes, this overrides your general settings. Remove both "set source-address" and "set source-interface", and it will start respecting the GeoIP setting:

...

unset source-address

unset source-interface

end

end

[ corrections always welcome ]

View solution in original post

14 REPLIES 14
pminarik
Staff
Staff

If by " SSL-VPN tunnel interface policy" you mean the firewall policy in <ssl.root> -> <another interface> direction, then those apply to already-tunneled traffic. The source-address of these policies needs to match the IP the VPN clients get assigned in the tunnel.

Applying geo-IP objects to source-address there is incorrect configuration.

[ corrections always welcome ]
DT3
New Contributor

OK, yes that is what I mean, so is limit access to specific hosts in SSL-VPN settings the only place it needs to be set?

 

Also is it best practice to change the 'All' in Firewall policy ssl.root to reflect the IP the client is assigned over VPN or doesn't it matter?

 

Thanks

pminarik

> so is limit access to specific hosts in SSL-VPN settings the only place it needs to be set?

Yes.
The primary, immediately visible, place to do this restriction is restricting the source-address in general SSL-VPN settings, as you already know.

 

There are two additional advanced options:

- local-in policy (CLI only, config firewall local-in-policy; benefit: not "vulnerable" to the ability to override the visible SSL-VPN setting with CLI-only exceptions in portal mapping rules [config vpn ssl setting > config auth-rule > <here>])

- setting up SSL-VPN on a loopback interface and "routing" to it through a regulard firewall policy (benefit: can apply more types of dynamic address objects)

 

> Also is it best practice to change the 'All' in Firewall policy ssl.root to reflect the IP the client is assigned over VPN or doesn't it matter?

 

In my opinion, this is entirely optional. Anybody who posseses the knowledge required to authenticate to your VPN (username/password/certificate/IP/port/etc) will by default just use whatever IP they were given by the FortiGate, so there's no realistic scenario where setting the SSL-VPN firewall policy would catch something malicious by switching from "all" to "<ssl-vpn-ip-pool>".

[ corrections always welcome ]
DT3
New Contributor

I have set this in general SSL-VPN settings, and it has made no difference sadly, I set France here and users in the UK were still able to connect to the VPN successfully.

pminarik

In that case review two parts:

1: The portal mappings:

show vpn ssl settings

...

config authentication-rule

<check for any "set source-address" line here>

...

 

2: Check what the FortiGate thinks about the UK user's IP address:

diag geoip ip2country <ip-address>

[ corrections always welcome ]
DT3
New Contributor

Hi, so yes on most there are just set users and set portal.

 

on the one in question I have 

 

set source-interface "any"
set source-address "all"

 

Why would that be?

pminarik

Yes, this overrides your general settings. Remove both "set source-address" and "set source-interface", and it will start respecting the GeoIP setting:

...

unset source-address

unset source-interface

end

end

[ corrections always welcome ]
DT3
New Contributor

Thanks so much for your input, would these entries be there for any particular reason?

pminarik

any+all is wide open and just mirrors the general settings, i.e. it's completely pointless to configure unless other entries have specific restrictions of their own.

 

This may have been some legacy settings that someone configured at some point in the past, possibly not even knowing what exactly they do. I've encountered multiple customers in the past who weren't aware of using these options at all.

[ corrections always welcome ]
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors