Restricting IPsec VPN Access by Geo-Location on FortiGate

In this article, i’ll show you how to restrict IPsec tunnel access on a FortiGate firewall so that only predefined geographic locations (or IP address groups) are allowed.

Background

Until now, we’ve been using SSL-VPN connections on FortiGate firewalls for remote access to customer networks. In the SSL-VPN settings of the GUI, you could easily add an address-group object containing the allowed geo-locations from which users could connect.

However, the FortiGate GUI does not yet support geo-filtering for IPsec tunnels. Fortunately, you can achieve the same result via the CLI.

Step 1: Define Geographic Address Objects

First, create individual address objects for each country you want to allow, then group them:

config firewall address
edit Geo_Netherlands
set type geography
set country NL
next
edit Geo_Belgium
set type geography
set country BE
next
end
config firewall addrgrp
edit ipsec_allow_locations
set member Geo_Belgium Geo_Netherlands
next
end

Here, we’ve created an address group named ipsec_allow_locations that includes Belgium and the Netherlands. We’ll reference this group in our local-in policy.

Step 2: Configure the Local-In Policy

Next, define a local-in policy that applies the address group to IPsec traffic on your WAN interface:

config firewall local-in-policy
edit 1
set intf wan1
set srcaddr ipsec_allow_locations
set dstaddr all
set action accept
set service IKE ESP
set schedule always
next
edit 2
set intf wan1
set srcaddr all
set dstaddr all
set action deny
set service IKE ESP
set schedule always
next
end

• Rule 1 permits IKE and ESP traffic sourced from our ipsec_allow_locations group.
• Rule 2 (placed below) denies all other IPsec traffic—acting as an implicit deny.

Note: Make sure you’re using the correct WAN interface name for your setup (in this example, wan1).

And that’s it! With just a few CLI commands, you’ve locked down your IPsec VPN so only connections from Belgium and the Netherlands are accepted—greatly enhancing your network’s security posture.

Source: (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restrict-IPsec-VPN-access-to-certain-countries/ta-p/192328) - archived link: https://archive.ph/rrC1Y