Fortigate Country Blocking | Geo Blocking | Local In Policy Setup + Script!

[@doghousemine]

Thanks for keeping it clean and simple. Appreciate it.

[@oliverk.7422]

Thank your for the script! I was close to adding it all from the Gui. Coming from a Sophos UTM where you have a convenient GUI page with all countries listed and you just need to click 'select all' I was shocked how Fortinet implemented geoblocking.

[@thegoodguy5541]

GODS WORK!!!! Thank you soo much.

[@SeanLongoria-p9n]

So much help! Thanks!

[@marcf9635]

Thanks useful info in todays climate!

[@coreybrown8864]

Great video. Keep up the good work.

[@marliearellano2978]

Awesome vid!🙂

[@workskirv]

Informative and easy to follow

[@gingerbadger]

Nice! Thank you. Was missing match- vip

[@TechSoul4U]

Great video... to the point. thanks

[@chrischilds2868]

Doesn't setting trusted hosts essentially do the same thing and in a much less complex way? We have all our Fortigates locked down to just our WAN IP and the local data subnet for admin access.

[@michaelschultz9454]

Thanks for this script. It was looking like I was going to need to make one myself but I figured this has to be a common enough need that someone would have created it already. Honestly it's kind of dumb the way Fortinet executes this feature, and they should just add this script to the KBs or make a better way.

[@jaredcarmouche4046]

Felt the same way... Bit the bullet and did it myself lol

[@thegoodguy5541]

@@jaredcarmouche4046 Heartfelt thank you

[@dtcoleman05]

Great!! However, do you have an example for only allowing Unites states IPs on specific policy inbound using VIP? For instance, I have an IPv4 policy (VIP) established that no other country should be hitting, only the US. Should I just change "Source"- from all to the United States? Then in cli set match-vip enable on that particular VIP policy?

[@ruhirezaie7947]

Yes, changing the 'source' from 'all' to United States will do the job. But 'set match-vip enable' doesn't work for Accept policies, it only works on Deny policies.

[@blaketomlinson3915]

dude thank you so much!

[@TheQuadrider21]

Thank you, I was missing the Match-vip enable in policy and was wondering why there were no logs... Per the local in policy, we only allow FMG-Access and Ping on our Wan ports, but we do have SSLVPN turned on. Does the local in alow filter for the SSL users? or only the WAN ports?

[@jaredcarmouche4046]

That's a great question, I think you can apply it to the ssl vpn interface as well.

[@hafezelashry2275]

​@@jaredcarmouche4046 I don't think this point because the virtual interface is sub interface from physical interface, if you have any info more please share with us about this point

[@hafezelashry2275]

Great video

[@cybersecprep6003]

Excellent Video.

[@sammahajan566]

very cool video...any thought of using the negate option (so basically you create a rule that says any traffic NOT from the US, block....?

[@mnsb166]

Big Thanks to you bro...

[@Iv4nTech]

thus Geolocation work on inbound policy who had natted public IP?

[@quick-updatetv4675]

does VPN client affected on this setup? just curios if ill be in china and I want to access my internal files in US since all are block should VPN Client be also affected..

[@urvhalt]

Is there the possibility to drop ( drop on floor ) instead of deny? Denial usually means to send a packet back..

[@piratarebel]

sorry I have a doubt, what is the difference blocking IP address by firewall policy than blocking it by local in policy?

[@ruhirezaie7947]

Local-in firewall policy is when the attackers want to access your administrative interface (HTTPS, HTTP, SSH etc.), like when they want to login to your firewall administratively.

[@denisstpierre7140]

Question. If we wanted to allow only for instance Canada. Could we configure Canada as an address and accept only that one. Using Negate Source?

[@HRCFan]

Yes, but then another policy after to deny all other countries.

[@sachivmehra537]

Hi - the set match-vip enable looks to be deprecated or not working on fortios 7.0? Any ideas?

[@ruhirezaie7947]

It works but only on Deny policies moving forward.

[@fernandoaberguno9613]

Thanks!!

[@EJJackson]

Nice video...simple and easy to use. Suggestion....in the script you have can you make the Address not visible. The reason I ask is now I need to change the visibility on all the countries in the Address list. I'm always using the Group in Addresses, not the individual country name. I'm changing the country visibility manually. Maybe you have a suggestion for changing the visibility in bulk

[@jaredcarmouche4046]

Great suggestion, I'm pretty sure I can just copy paste the command for that in the script.

[@jaredcarmouche4046]

Taking a closer look, all you would have to do is add this line to every address entry: set visibility disable

[@VijayKumar-tk9ym]

Thank you

[@angelical791]

Thank you, Great video. Script ?