Hi,
I use FG600D (Fortios V5.4.5) with 30 VPN (IKE) but since few weeks i have trouble with some public ip like 216.218.206.126. Each night i have a lot of attempts to establish VPN IKE. This public ip is not public ip of my company.
For example :
Message meets Alert condition
date=2018-06-03 time=04:47:33 devname=FW-BLC-1 devid=FGT6HDXXXXXXX logid=0101037128 type=event subtype=vpn level=error vd=root logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action=negotiate remip=[style="background-color: #ffff00;"]216.218.206.102[/style] locip=xxx.xxx.xxx.xxx remport=24916 locport=500 outintf="IP-Pub-Complete" cookies="3e35c70729dfedef/0000000000000000" user="N/A" group="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status=failure init=remote mode=main dir=inbound stage=1 role=responder result=ERROR
I try to use local in policy but i don't understand how. In my all Fortigate i saw local in policy in GUI but in CLI i have nothing.
Please could you tell me if it's the good way to block unwanted public ip ? and if it's the good way could you explained me how can i do ?
In Example i found, all people explain to choose wan interface for source but i don't know which destination interface i must select.
Thank you,
François
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi, There is a similar post here https://forum.fortinet.com/tm.aspx?tree=true&m=160521&mpage=1 that should help. Best, Markus
________________________________________________________
--- NSE 4 ---
________________________________________________________
Thank you Markus for your reply but i don't understand why i can't see local policy in CLI ?
In example gave by Stuart he explained i use "edit 1" but in my case i don't have any policy. If i do "edit 1" i create a new policy.
At the same time in GUI i have aproximatively 80 or 100 local in policy.
Thank you for help,
I don't think local-in policy is available in GUI. You must be talking about regular firewall/security policies in GUI. If you don't see anything under "configure firewall local-in-policy", you don't have "local-in" policy yet. So edit 1 or edit 0 create a new policy with id:1.
Hi,
Thank you Toshi,
I create local in policy but is nbot working like i want.
I add 4 rules in local in policy
config firewall local-in-policy
edit 1
set ha-mgmt-intf-only disable
set intf "Orange-Fibre"
set srcaddr "Block-IP-1"
set dstaddr "all"
set action deny
set service "IKE"
set schedule "always"
set status enable
next
edit 2
set ha-mgmt-intf-only disable
set intf "Orange-Fibre"
set srcaddr "Block-IP-1"
set dstaddr "all"
set action deny
set service "ESP"
set schedule "always"
set status enable
next
edit 3
set ha-mgmt-intf-only disable
set intf "Orange-Fibre"
--More-- set srcaddr "all"
set dstaddr "MyPulbic"
set action accept
set service "IKE"
set schedule "always"
set status enable
next
edit 4
set ha-mgmt-intf-only disable
set intf "Orange-Fibre"
set srcaddr "all"
set dstaddr "MyPulbic"
set action accept
set service "ESP"
set schedule "always"
set status enable
next
end
My idea for test is to block only one public ip of another Fortigate i manage.
Public ip of another fortigate is in srcaddr "Block-IP-1"
When i apply this rules my VPN doesn't stop and continue to work. I try to bring downd and bring up but VPN continue to work.
Perhaps i don't undrstand something ?
Thank you for your help,
François
Is the interface "Orange-Fibre" the IPSec interface or a physical interface? In the thread Markus pointed to had an IPSec interface.
Hi Toshi,
I added a screenshot to show you. In fact i apply to wan interface and not to IPSEC interface.
I don't understand why i must apply to IPSEC interface ? if i want to block some bad public ip to mount IPSEC i don't create an interface IPSEC for it.
This morning i modify local in policy and i replace :
set service IKE
by
set service ALL
In this case the first Fortigate (which i apply local in policy), tunnel continue to bring up but on another side of VPN the second Fortigate show tunnel down. I think it's normal because flow is sending by first fortigate and it use the same chanel for reply (it's just an idea)
In my test configuration i think i must apply local in policy on two fortigate because each one can initialize IPSEC. In case of bad public ip which want to try open IPSEC is different.
I'll keep you informed and if you could confirm different idea ?
François
Hi François Here's my config. I only enable Swiss IPs to connect (IPSec and SIP) to my Wan Interface (in your case it's the Orange I assume). config firewall local-in-policy edit 1 set intf "wan1" set srcaddr "zGeoSwiss" set dstaddr "all" set action accept set service "GRE" "IKE" "SIP" set schedule "always" next edit 2 set intf "wan1" set srcaddr "all" set dstaddr "all" set service "IKE" "GRE" "SIP" set schedule "always" next end First you have to enable all sources that are allowed to use the defined Services. Then you block all others (edit 2).
I hope this clarify how the local-in policy works. Best,
Markus
________________________________________________________
--- NSE 4 ---
________________________________________________________
For convenience, you can find configs for all countries, converted to address objects and an address group, on my website.
Hi guys,
Thank you for all to your answers.
@Toshi: I don't create interface-mode IPSec vpn, i just only want to reject public ip which want to use IKe.
@Bruno: Yes i know shadowserver but it's not really good to receive 50 or 60 emails by night. I prefer reject this public ip and some other to be sure.
@Markus: Good i think it's the similar configuration i have today, but i think you forgot "set action Deny" on Edit 2 isn't it ?
@ede_pfau: It's another good solution but i keep you idea.
Best regards,
François
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1558 | |
1033 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.