Control administrative access with a local-in policy

Administrative access to FortiManager can be controlled by a IPv4/IPv6 local-in policy. This feature can only be configured using the FortiManager CLI.

For more information, see the FortiManager CLI Reference Guide on the Fortinet Docs Library.

To create an IPv4 local-in policy to control administrator access to FortiManager:

1. Access the FortiManager CLI.
2. Enter the following command to create the IPv4 local-in policy:

   config system local-in-policy

   edit <policy ID>

   new entry '<Policy ID>' added

3. Configure additional settings for the local-in policy using the set command.
   For example:

   set

   action - Action performed on traffic matching this policy.

   dport - Destination port number (0 for all).

   dst - Destination IP and mask.

   intf - Incoming interface name.

   protocol - Traffic protocol.

   src - Source IP and mask.

To create an IPv6 local-in policy to control administrator access to FortiManager:

1. Access the FortiManager CLI.
2. Enter the following command to create the IPv6 local-in policy:

   config system local-in-policy6

   (local-in-policy6)# edit <policy ID>

   new entry '<Policy ID>' added

3. Configure additional settings for the local-in policy using the set command.
   For example:

   set

   action - Action performed on traffic matching this policy.

   dport - Destination port number (0 for all).

   dst - Destination IP and mask.

   intf - Incoming interface name.

   protocol - Traffic protocol.

   src - Source IP and mask.

FortiManager local-in policies support multiple entries when configuring ports, addresses, and interfaces. For example: config system local-in-policy edit 1 set description "IP group 123" set dport "22" "443" "80" "8080" "514" set dst "1.1.1.1/16" "2.2.2.2/24" "3.3.3.3/32" set intf "port1" "port2" set src "1.1.1.1/16" "2.2.2.2/24"