allowing a country for IPsec remote access vpn

[rezafathi]

Hi

I have configured ipsec remote access vpn and I want to allow only IPs from united kingdom to be able to connect to my FGT. how can i do that?

[b34rded-1der]

Hi Reza, 

You can create a new address object under Policy & Objects → Addresses, with type Geography, and select United Kingdom as the country. 

After creating the address object, you can restrict sources under VPN → SSL-VPN Settings using the object you created.  

[rezafathi]

Hi

Thanks. But I want a solution for ipsec remote access vpn.

[ebilcari]

For IPSec you have to limit access using "local in" policies, as explained in this article.

[rezafathi]

Thanks. How can i see the blocked logs in logs and reports?

[ebilcari]

The logs should be available under Local Traffic. You can also enable debugging as shown in the guide to check that the local policy is applied correctly.

[rezafathi]

I have 2 wan interfaces for ipsec remote access. Do i need to create 2 allow policirs first and then 2 deny policies?

[ebilcari · Accepted solution]

Yes correct. You can not use multiple interfaces on the same local policy and there is no implicit deny preconfigured: "Unlike IPv4 policies, there is no default implicit deny policy."

For the deny rule you can use one entry: set intf "any" 
config firewall local-in-policy
 edit 2
  set intf "any"
  set srcaddr "all"
  set dstaddr "eth1" "eth0"
  set service "IKE"
  set schedule "always"

[funkylicious]

Hi,

You can use this link and achieve what you are trying.

https://yurisk.info/2022/07/04/fortigate-local-in-policy-configuration-examples-for-vpn-ipsec-vpn-ss...

Create the geo address for UK and use it in the local-in policy to permit IKE/ESP and then another rule which will deny everything else.

[rezafathi]

Hi, thanks. can I achieve this by using firewall policy instead of local-in policy?