how to block specific external IP avoiding from VPN login?

[junior]

Hi all, as title, a stranger attempts to login our VPN from a specific external IP such as 85.56.83.8, do you know how to block it? or any other solutions?

Thanks in advance.

[Toshi_Esumi]

General answer would be "local-in policy" described in below post.

https://community.fortinet.com/t5/Fortinet-Forum/How-to-block-external-IP-to-avoid-connection-from-i...

Toshi

[sharmaj]

Hi ,

If you have multiple such IPs, you can actually block them using the IP threat feed database and add that into the policy pertaining to VPN.

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/625349/external-block-list-threat-fe...

[ede_pfau]

AFAICT, threat feed cannot be used in local-in policies.

[junior]

is there any other advice?

[ede_pfau]

local-in policy is the way to go. It's effective and available. What else do you need?

[junior]

Hi, it's like the commands?

config firewall local-in-policy
edit 0
set intf "WAN"
set srcaddr "81.59.52.3"
set dstaddr "all"
set service "ALL"
set schedule "always"

[ede_pfau]

Yup. Default action is DENY and will not show up using "show", but when you use "show full". Check to be sure.

Over time you will collect some number of 'hostile' public IPs. Put them into an address group and use the group in the local-in policy. This way, to add an address, you only have to edit the group and can leave the policy alone.

[Debbie_FTNT]

Hey junior,

that looks about right - it should block that 81.59.52.3 IP from accessing the FortiGate.