Restricting Management Access to Fortigate Firewalls

Sometimes it’s just unavoidable that you need to do in-band management of firewalls. This is particularly the case if the firewall is hosted externally – such as within AWS. Here’s a quick recipe on restricting management access to the Fortigate firewall.

I’ve written a similar topic for the Juniper SRX on controlling management access to the system by client IP address, so to maintain the thread here’s how to do the same for the Fortigate.

Unfortunately, it’s not so easy to do as with Junos. You’ll need to get into the FortiOS command-line interface to do this, nevertheless it’s fairly straightforward.

Create Object Group for Management Clients

Firstly, create an IP address object group in the web GUI. Call it Firewall_Management

Configure the Inbound Policy

Now, log into the command-line interface ( CLI ). You can do this via an SSH session or using the CLI window in the web GUI dashboard.

Here’s the dialog:

Fortigate # 
Fortigate # config firewall local-in-policy 

Fortigate (local-in-policy) # ?
edit      Add/edit a table value.
delete    Delete a table value.
purge     Clear all table values.
move      Move an ordered table value.
clone     Clone a table entry.
get       Get dynamic and system information.
show      Show configuration.
end       End and save last config.
 
Fortigate (local-in-policy) # show

Fortigate (local-in-policy) # edit 1
new entry '1' added

Fortigate (1) # set ?
*intf                 Source interface name.
*srcaddr              Source address name.
*dstaddr              Destination address name.
action               Local-In policy action.
*service              Service name.
*schedule             Schedule name.
auto-asic-offload    Enable/disable policy traffic ASIC offloading.
status               Enable/disable policy status.
 
Fortigate (1) # set intf 
<string>        please input string value
any             match any interface in the virtual domain
    
Internet        interface
port1(External) interface
port2(Internal) interface
port3(DMZ)      interface

Fortigate (1) # set intf Internet 

Fortigate (1) # set srcaddr Firewall_Management 

Fortigate (1) # set dstaddr al
*name    Address name.

Fortigate (1) # set dstaddr all
entry not found in datasource

value parse error before 'all'
Command fail. Return code -3

Fortigate (1) # set dstaddr Any

Fortigate (1) # set action accept 

Fortigate (1) # set service SSH HTTPS

Fortigate (1) # set schedule always 

Fortigate (1) # show
config firewall local-in-policy
    edit 1
        set intf "Internet"
        set srcaddr "Firewall_Management"
        set dstaddr "Any"
        set action accept
        set service "SSH" "HTTPS"
        set schedule "always"
    next
end

Fortigate (1) # next

Fortigate (local-in-policy) # edit 2
new entry '2' added

Fortigate (2) # set intf "Internet"

Fortigate (2) # set srcaddr Any

Fortigate (2) # set dstaddr Any

Fortigate (2) # set service SSH HTTPS

Fortigate (2) # set schedule always 

Fortigate (2) # set action deny 

Fortigate (2) # show
config firewall local-in-policy
    edit 2
        set intf "Internet"
        set srcaddr "Any"
        set dstaddr "Any"
        set service "SSH" "HTTPS"
        set schedule "always"
    next
end

Fortigate (2) # next

Fortigate (local-in-policy) # 
edit      Add/edit a table value.
delete    Delete a table value.
purge     Clear all table values.
move      Move an ordered table value.
clone     Clone a table entry.
get       Get dynamic and system information.
show      Show configuration.
end       End and save last config.
 
Fortigate (local-in-policy) # show
config firewall local-in-policy
    edit 1
        set intf "Internet"
        set srcaddr "Firewall_Management"
        set dstaddr "Any"
        set action accept
        set service "SSH" "HTTPS"
        set schedule "always"
    next
    edit 2
        set intf "Internet"
        set srcaddr "Any"
        set dstaddr "Any"
        set service "SSH" "HTTPS"
        set schedule "always"
    next
end

Fortigate (local-in-policy) # end

Fortigate # 
Fortigate # 
Fortigate # config firewall local-in-policy 

Fortigate (local-in-policy) # ?
edit      Add/edit a table value.
delete    Delete a table value.
purge     Clear all table values.
move      Move an ordered table value.
clone     Clone a table entry.
get       Get dynamic and system information.
show      Show configuration.
end       End and save last config.
 
Fortigate (local-in-policy) # show

Fortigate (local-in-policy) # edit 1
new entry '1' added

Fortigate (1) # set ?
*intf                 Source interface name.
*srcaddr              Source address name.
*dstaddr              Destination address name.
action               Local-In policy action.
*service              Service name.
*schedule             Schedule name.
auto-asic-offload    Enable/disable policy traffic ASIC offloading.
status               Enable/disable policy status.
 
Fortigate (1) # set intf 
<string>        please input string value
any             match any interface in the virtual domain
    
Internet        interface
port1(External) interface
port2(Internal) interface
port3(DMZ)      interface

Fortigate (1) # set intf Internet 

Fortigate (1) # set srcaddr Firewall_Management 

Fortigate (1) # set dstaddr al
*name    Address name.

Fortigate (1) # set dstaddr all
entry not found in datasource

value parse error before 'all'
Command fail. Return code -3

Fortigate (1) # set dstaddr Any

Fortigate (1) # set action accept 

Fortigate (1) # set service SSH HTTPS

Fortigate (1) # set schedule always 

Fortigate (1) # show
config firewall local-in-policy
    edit 1
        set intf "Internet"
        set srcaddr "Firewall_Management"
        set dstaddr "Any"
        set action accept
        set service "SSH" "HTTPS"
        set schedule "always"
    next
end

Fortigate (1) # next

Fortigate (local-in-policy) # edit 2
new entry '2' added

Fortigate (2) # set intf "Internet"

Fortigate (2) # set srcaddr Any

Fortigate (2) # set dstaddr Any

Fortigate (2) # set service SSH HTTPS

Fortigate (2) # set schedule always 

Fortigate (2) # set action deny 

Fortigate (2) # show
config firewall local-in-policy
    edit 2
        set intf "Internet"
        set srcaddr "Any"
        set dstaddr "Any"
        set service "SSH" "HTTPS"
        set schedule "always"
    next
end

Fortigate (2) # next

Fortigate (local-in-policy) # 
edit      Add/edit a table value.
delete    Delete a table value.
purge     Clear all table values.
move      Move an ordered table value.
clone     Clone a table entry.
get       Get dynamic and system information.
show      Show configuration.
end       End and save last config.
 
Fortigate (local-in-policy) # show
config firewall local-in-policy
    edit 1
        set intf "Internet"
        set srcaddr "Firewall_Management"
        set dstaddr "Any"
        set action accept
        set service "SSH" "HTTPS"
        set schedule "always"
    next
    edit 2
        set intf "Internet"
        set srcaddr "Any"
        set dstaddr "Any"
        set service "SSH" "HTTPS"
        set schedule "always"
    next
end

Fortigate (local-in-policy) # end

Fortigate #

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

Fortigate #

Fortigate # config firewall local-in-policy

Fortigate (local-in-policy) # ?

edit Add/edit a table value.

delete Delete a table value.

purge Clear all table values.

move Move an ordered table value.

clone Clone a table entry.

get Get dynamic and system information.

show Show configuration.

end End and save last config.

Fortigate (local-in-policy) # show

Fortigate (local-in-policy) # edit 1

new entry '1' added

Fortigate (1) # set ?

*intf Source interface name.

*srcaddr Source address name.

*dstaddr Destination address name.

action Local-In policy action.

*service Service name.

*schedule Schedule name.

auto-asic-offload Enable/disable policy traffic ASIC offloading.

status Enable/disable policy status.

Fortigate (1) # set intf

<string> please input string value

any match any interface in the virtual domain

Internet interface

port1(External) interface

port2(Internal) interface

port3(DMZ) interface

Fortigate (1) # set intf Internet

Fortigate (1) # set srcaddr Firewall_Management

Fortigate (1) # set dstaddr al

*name Address name.

Fortigate (1) # set dstaddr all

entry not found in datasource

value parse error before 'all'

Command fail. Return code -3

Fortigate (1) # set dstaddr Any

Fortigate (1) # set action accept

Fortigate (1) # set service SSH HTTPS

Fortigate (1) # set schedule always

Fortigate (1) # show

config firewall local-in-policy

edit 1

set intf "Internet"

set srcaddr "Firewall_Management"

set dstaddr "Any"

set action accept

set service "SSH" "HTTPS"

set schedule "always"

end

Fortigate (1) # next

Fortigate (local-in-policy) # edit 2

new entry '2' added

Fortigate (2) # set intf "Internet"

Fortigate (2) # set srcaddr Any

Fortigate (2) # set dstaddr Any

Fortigate (2) # set service SSH HTTPS

Fortigate (2) # set schedule always

Fortigate (2) # set action deny

Fortigate (2) # show

config firewall local-in-policy

edit 2

set intf "Internet"

set srcaddr "Any"

set dstaddr "Any"

set service "SSH" "HTTPS"

set schedule "always"

end

Fortigate (2) # next

Fortigate (local-in-policy) #

edit Add/edit a table value.

delete Delete a table value.

purge Clear all table values.

move Move an ordered table value.

clone Clone a table entry.

get Get dynamic and system information.

show Show configuration.

end End and save last config.

Fortigate (local-in-policy) # show

config firewall local-in-policy

edit 1

set intf "Internet"

set srcaddr "Firewall_Management"

set dstaddr "Any"

set action accept

set service "SSH" "HTTPS"

set schedule "always"

edit 2

set intf "Internet"

set srcaddr "Any"

set dstaddr "Any"

set service "SSH" "HTTPS"

set schedule "always"

end

Fortigate (local-in-policy) # end

Fortigate #

Fortigate # config firewall local-in-policy

Fortigate (local-in-policy) # ?

edit Add/edit a table value.

delete Delete a table value.

purge Clear all table values.

move Move an ordered table value.

clone Clone a table entry.

get Get dynamic and system information.

show Show configuration.

end End and save last config.

Fortigate (local-in-policy) # show

Fortigate (local-in-policy) # edit 1

new entry '1' added

Fortigate (1) # set ?

*intf Source interface name.

*srcaddr Source address name.

*dstaddr Destination address name.

action Local-In policy action.

*service Service name.

*schedule Schedule name.

auto-asic-offload Enable/disable policy traffic ASIC offloading.

status Enable/disable policy status.

Fortigate (1) # set intf

<string> please input string value

any match any interface in the virtual domain

Internet interface

port1(External) interface

port2(Internal) interface

port3(DMZ) interface

Fortigate (1) # set intf Internet

Fortigate (1) # set srcaddr Firewall_Management

Fortigate (1) # set dstaddr al

*name Address name.

Fortigate (1) # set dstaddr all

entry not found in datasource

value parse error before 'all'

Command fail. Return code -3

Fortigate (1) # set dstaddr Any

Fortigate (1) # set action accept

Fortigate (1) # set service SSH HTTPS

Fortigate (1) # set schedule always

Fortigate (1) # show

config firewall local-in-policy

edit 1

set intf "Internet"

set srcaddr "Firewall_Management"

set dstaddr "Any"

set action accept

set service "SSH" "HTTPS"

set schedule "always"

end

Fortigate (1) # next

Fortigate (local-in-policy) # edit 2

new entry '2' added

Fortigate (2) # set intf "Internet"

Fortigate (2) # set srcaddr Any

Fortigate (2) # set dstaddr Any

Fortigate (2) # set service SSH HTTPS

Fortigate (2) # set schedule always

Fortigate (2) # set action deny

Fortigate (2) # show

config firewall local-in-policy

edit 2

set intf "Internet"

set srcaddr "Any"

set dstaddr "Any"

set service "SSH" "HTTPS"

set schedule "always"

end

Fortigate (2) # next

Fortigate (local-in-policy) #

edit Add/edit a table value.

delete Delete a table value.

purge Clear all table values.

move Move an ordered table value.

clone Clone a table entry.

get Get dynamic and system information.

show Show configuration.

end End and save last config.

Fortigate (local-in-policy) # show

config firewall local-in-policy

edit 1

set intf "Internet"

set srcaddr "Firewall_Management"

set dstaddr "Any"

set action accept

set service "SSH" "HTTPS"

set schedule "always"

edit 2

set intf "Internet"

set srcaddr "Any"

set dstaddr "Any"

set service "SSH" "HTTPS"

set schedule "always"

end

Fortigate (local-in-policy) # end

Fortigate #

Verification and testing

Here’s the verification and testing steps to confirm everything is all good:

Confirm that access from members of the Firewall_Management group can connect with SSH and HTTPS OK
Confirm that access from a few other clients cannot access the management interface

Restricting Management Access to Fortigate Firewalls

Create Object Group for Management Clients

Configure the Inbound Policy

Verification and testing

Kerry