FortiGate-Local-in policy介紹與設定

前言：

FortiGate可以使用Local-in-plicy控管存取Interface的流量，在一般的狀況下可以透過Interface的Administrative Access或Administrator的Trust host進行控管，但如果需要進行更精細的控管如：允許特定國家的來源IP存取Interface服務、封鎖所有流量只放行特定IP存取等需求時就可以搭配Local-in-plicy達成，所以可以把Local-in-plicy視為加強資安的重要手段。

環境說明：

FortiOS版本：After 6.0

Local-in-policy情境：

情境1：只允許特定來源IP存取ICMP

config firewall local-in-policy
edit 2
set intf “port1”
set srcaddr “172.16.4.231”
set dstaddr “all”
set action accept
set service “ICMP”
set schedule “always”
set status enable
next
edit 1
set intf “port1”
set srcaddr “all”
set dstaddr “all”
set service “ICMP”
set action deny
set schedule “always”
set status enable
next
end

情境2：阻擋所有流量只允許特定來源IP存取ICMP、HTTPS

config firewall local-in-policy
edit 2
set intf “port1”
set srcaddr “172.16.4.231”
set dstaddr “all”
set action accept
set service “ICMP” “HTTPS”
set schedule “always”
set status enable
next
edit 1
set intf “port1”
set srcaddr “all”
set dstaddr “all”
set service “ALL”
set action deny
set schedule “always”
set status enable
next
end

情境3：允許來源國家Taiwan的IP連線SSL-VPN

config firewall local-in-policy
edit 3
set intf “port1”
set srcaddr “TW”
set dstaddr “all”
set action accept
set service “SSL-VPN”
set schedule “always”
set status enable
next
end

#小提醒：Local-in-plicy的比對順序是由上往下進行，如有多筆policies可以使用move指令調整順序