Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
François
New Contributor III

black list public ip IKE protocol

Hi,

 

I use FG600D (Fortios V5.4.5) with 30 VPN (IKE) but since few weeks i have trouble with some public ip like 216.218.206.126. Each night i have a lot of attempts to establish VPN IKE. This public ip is not public ip of my company.

For example :

Message meets Alert condition

date=2018-06-03 time=04:47:33 devname=FW-BLC-1 devid=FGT6HDXXXXXXX logid=0101037128 type=event subtype=vpn level=error vd=root logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action=negotiate remip=[style="background-color: #ffff00;"]216.218.206.102[/style] locip=xxx.xxx.xxx.xxx remport=24916 locport=500 outintf="IP-Pub-Complete" cookies="3e35c70729dfedef/0000000000000000" user="N/A" group="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status=failure init=remote mode=main dir=inbound stage=1 role=responder result=ERROR

 

 

I try to use local in policy but i don't understand how. In my all Fortigate i saw local in policy in GUI but in CLI i have nothing. 

Please could you tell me if it's the good way to block unwanted public ip ? and if it's the good way could you explained me how can i do ?

 

In Example i found, all people explain to choose wan interface for source but i don't know which destination interface i must select.

 

Thank you,

François

 

14 REPLIES 14
Markus
Valued Contributor

Hi, There is a similar post here https://forum.fortinet.com/tm.aspx?tree=true&m=160521&mpage=1 that should help. Best, Markus


________________________________________________________
--- NSE 4 ---
________________________________________________________

________________________________________________________--- NSE 4 ---________________________________________________________
François
New Contributor III

Thank you Markus for your reply but i don't understand why i can't see local policy in CLI ?

In example gave by Stuart he explained i use "edit 1" but in my case i don't have any policy. If i do "edit 1" i create a new policy.

At the same time in GUI i have aproximatively 80 or 100 local in policy.

 

Thank you for help,

Toshi_Esumi

I don't think local-in policy is available in GUI. You must be talking about regular firewall/security policies in GUI. If you don't see anything under "configure firewall local-in-policy", you don't have "local-in" policy yet. So edit 1 or edit 0 create a new policy with id:1.

François

Hi,

Thank you Toshi,

 

I create local in policy but is nbot working like i want.

 

I add 4 rules in local in policy

config firewall local-in-policy
    edit 1
        set ha-mgmt-intf-only disable
        set intf "Orange-Fibre"
        set srcaddr "Block-IP-1"
        set dstaddr "all"
        set action deny
        set service "IKE"
        set schedule "always"
        set status enable
    next
    edit 2
        set ha-mgmt-intf-only disable
        set intf "Orange-Fibre"
        set srcaddr "Block-IP-1"
        set dstaddr "all"
        set action deny
        set service "ESP"
        set schedule "always"
        set status enable
    next
    edit 3
        set ha-mgmt-intf-only disable
        set intf "Orange-Fibre"
--More--                  set srcaddr "all"
        set dstaddr "MyPulbic"
        set action accept
        set service "IKE"
        set schedule "always"
        set status enable
    next
    edit 4
        set ha-mgmt-intf-only disable
        set intf "Orange-Fibre"
        set srcaddr "all"
        set dstaddr "MyPulbic"
        set action accept
        set service "ESP"
        set schedule "always"
        set status enable
    next
end

 

My idea for test is to block only one public ip of another Fortigate i manage.

Public ip of another fortigate is in srcaddr "Block-IP-1"

When i apply this rules my VPN doesn't stop and continue to work. I try to bring downd and bring up but VPN continue to work.

 

Perhaps i don't undrstand something ?

 

Thank you for your help,

François

 

Toshi_Esumi

Is the interface "Orange-Fibre" the IPSec interface or a physical interface? In the thread Markus pointed to had an IPSec interface.

François

Hi Toshi,

 

I added a screenshot to show you. In fact i apply to wan interface and not to IPSEC interface. 

I don't understand why i must apply to IPSEC interface ? if i want to block some bad public ip to mount IPSEC i don't create an interface IPSEC for it.

 

This morning i modify local in policy and i replace :

set service IKE

by

set service  ALL

 

In this case the first Fortigate (which i apply local in policy), tunnel continue to bring up but on another side of VPN the second Fortigate show tunnel down. I think it's normal because flow is sending by first fortigate and it use the same chanel for reply (it's just an idea)

 

In my test configuration i think i must apply local in policy on two fortigate because each one can initialize IPSEC. In case of bad public ip which want to try open IPSEC is different.

 

I'll keep you informed and if you could confirm different idea ?

 

François 

 

 

 

 

Markus
Valued Contributor

Hi François Here's my config. I only enable Swiss IPs to connect (IPSec and SIP) to my Wan Interface (in your case it's the Orange I assume). config firewall local-in-policy     edit 1         set intf "wan1"         set srcaddr "zGeoSwiss"         set dstaddr "all"         set action accept         set service "GRE" "IKE" "SIP"         set schedule "always"     next     edit 2         set intf "wan1"         set srcaddr "all"         set dstaddr "all"         set service "IKE" "GRE" "SIP"         set schedule "always"     next end First you have to enable all sources that are allowed to use the defined Services. Then you block all others (edit 2).

I hope this clarify how the local-in policy works. Best,

Markus

 


________________________________________________________
--- NSE 4 ---
________________________________________________________

________________________________________________________--- NSE 4 ---________________________________________________________
ede_pfau

For convenience, you can find configs for all countries, converted to address objects and an address group, on my website.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
François
New Contributor III

Hi guys,

 

Thank you for all to your answers.

 

@Toshi: I don't create interface-mode IPSec vpn, i just only want to reject public ip which want to use IKe.

@Bruno: Yes i know shadowserver but it's not really good to receive 50 or 60 emails by night. I prefer reject this public ip and some other to be sure.

@Markus: Good i think it's the similar configuration i have today, but i think you forgot "set action Deny" on Edit 2 isn't it ?

@ede_pfau: It's another good solution but i keep you idea.

 

Best regards,

François

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors