hello
I need to restrict IPSEC VPN
I need to connect only from UAE if anyone try to connect from outside UAE he ca not
thanks
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
1) In FGT GUI, create one address object as below:
2) There is one pre-defined service object called "IKE";
3) Configure two local-in policies as below:
config firewall local-in-policy
edit 1
set intf "internal" <------------- This is the interface bound to your IPSec VPN
set srcaddr "UAE"
set dstaddr "all" <------- This can be your IPSec VPN local gateway IP (the IP assigned to the interface bound to your IPSec VPN)
set action accept
set service "IKE"
set schedule "always"
next
edit 2
set intf "internal1" <----- The interface bound to your IPSec VPN
set srcaddr "all"
set dstaddr "all" <---- This could be your IPSec VPN local gateway IP
set service "IKE"
set schedule "always"
next
end
NOTE: For policy 2, the action is Deny.
Hi @ahmadking22 ,
You may use the Local-in policy to restrict UAE country as the source only to access IPSec VPN ports 500 & 4500.
You have to configure the Local-in policy via CLI.
please can you tell me exactly what I need to do this
1) In FGT GUI, create one address object as below:
2) There is one pre-defined service object called "IKE";
3) Configure two local-in policies as below:
config firewall local-in-policy
edit 1
set intf "internal" <------------- This is the interface bound to your IPSec VPN
set srcaddr "UAE"
set dstaddr "all" <------- This can be your IPSec VPN local gateway IP (the IP assigned to the interface bound to your IPSec VPN)
set action accept
set service "IKE"
set schedule "always"
next
edit 2
set intf "internal1" <----- The interface bound to your IPSec VPN
set srcaddr "all"
set dstaddr "all" <---- This could be your IPSec VPN local gateway IP
set service "IKE"
set schedule "always"
next
end
NOTE: For policy 2, the action is Deny.
Hi @ahmadking22 ,
BTW, I hope that your FGT only has this IPSec VPN tunnel and no other IPSec VPN tunnels.
This is very much feasible via local in policy through CLI on FG or through GUI via FMG. We can create Geo location address group for source address, so in future if you need to allow additional country , you just need to include in group.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1711 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.