So, kinda new here. I wanted to block traffic inbound from, say, russia, china and korea. I set up a firewall rule as wan/lan/GEO/all (where GEO was the geographic list). No traffic. So I added another entry as a whitelist from any US traffic, as a positive test. Still nothing. Tried changing the dstinf from LAN to any (since I thought maybe the new rule - at the top of the rules list - didn't have a destination, so maybe LAN was wrong.) Still nothing. Finally, out of desperation, I created a VIP group, and added the various VIP entries (for my mail server, PBX server, etc...) Lo and behold, the whitelist entry worked. So I did the same thing for the GEO-IP blocklist, and that is also now working. My question: is this really necessary, or am I missing something crucial here? I've gone through the fortios 6.4.6 manual and saw nothing that spoke to this. FWIW, I am set in profile mode, not policy mode... I'm used to pfsense, where nat happens before acl, so you need to check the destination as the internal IP. But in this case, since I'm trying to block anything from GEO-IP, why didn't 'all' work as a destination?
Also, if this IS the correct way to do things, I assume the GEO-IP block rule should be entry #1?