SSL VPN Country Restriction

[DT3]

Hi,

I have recently tried to restrict our SSL VPN to one specific country. I have created the Geography Object for the country, added it under SSL-VPN Settings, limit access to specific hosts.

Under the SSL-VPN tunnel interface policy the source for IPs was all, so I have changed it to the object I created for the country as I understand the Country has to be set in both places.

The problem I am having is that users can connect, but once connected they cannot access anything. If I take the Country out of the SSL-VPN tunnel interface policy and change back to all it works fine.

As far as I can see I have implemted as recommended so unsure of where to go next. I have tried one two different VPN devices both with public IPs in the country I created.

[pminarik]

If by " SSL-VPN tunnel interface policy" you mean the firewall policy in <ssl.root> -> <another interface> direction, then those apply to already-tunneled traffic. The source-address of these policies needs to match the IP the VPN clients get assigned in the tunnel.

Applying geo-IP objects to source-address there is incorrect configuration.

[DT3]

OK, yes that is what I mean, so is limit access to specific hosts in SSL-VPN settings the only place it needs to be set?

Also is it best practice to change the 'All' in Firewall policy ssl.root to reflect the IP the client is assigned over VPN or doesn't it matter?

Thanks

[pminarik]

> so is limit access to specific hosts in SSL-VPN settings the only place it needs to be set?

Yes.
The primary, immediately visible, place to do this restriction is restricting the source-address in general SSL-VPN settings, as you already know.

There are two additional advanced options:

- local-in policy (CLI only, config firewall local-in-policy; benefit: not "vulnerable" to the ability to override the visible SSL-VPN setting with CLI-only exceptions in portal mapping rules [config vpn ssl setting > config auth-rule > <here>])

- setting up SSL-VPN on a loopback interface and "routing" to it through a regulard firewall policy (benefit: can apply more types of dynamic address objects)

> Also is it best practice to change the 'All' in Firewall policy ssl.root to reflect the IP the client is assigned over VPN or doesn't it matter?

In my opinion, this is entirely optional. Anybody who posseses the knowledge required to authenticate to your VPN (username/password/certificate/IP/port/etc) will by default just use whatever IP they were given by the FortiGate, so there's no realistic scenario where setting the SSL-VPN firewall policy would catch something malicious by switching from "all" to "<ssl-vpn-ip-pool>".

[DT3]

I have set this in general SSL-VPN settings, and it has made no difference sadly, I set France here and users in the UK were still able to connect to the VPN successfully.

[pminarik]

In that case review two parts:

1: The portal mappings:

show vpn ssl settings

...

config authentication-rule

<check for any "set source-address" line here>

...

2: Check what the FortiGate thinks about the UK user's IP address:

diag geoip ip2country <ip-address>

[DT3]

Hi, so yes on most there are just set users and set portal.

on the one in question I have 

set source-interface "any"
set source-address "all"

Why would that be?

[pminarik · Accepted solution]

Yes, this overrides your general settings. Remove both "set source-address" and "set source-interface", and it will start respecting the GeoIP setting:

...

unset source-address

unset source-interface

end

end

[DT3]

Thanks so much for your input, would these entries be there for any particular reason?

[pminarik]

any+all is wide open and just mirrors the general settings, i.e. it's completely pointless to configure unless other entries have specific restrictions of their own.

This may have been some legacy settings that someone configured at some point in the past, possibly not even knowing what exactly they do. I've encountered multiple customers in the past who weren't aware of using these options at all.