Blocking geographic regions in Fortigate 5.4

The best docs are always at

Sometimes I get asked by clients how to block know attacking countries like Russia, or China from accessing their websites. I often hear that only US connections would be accessing their services so why allow others who might not be on the up and up.

Of course most attackers might pivot from compromised computers in the US, and thus bypass this security feature, but either way its not a bad idea. The below gives a good example on how to create a firewall “country” group and then block those countries from accessing any services hosted through the firewall. This will be done in Forti-OS 5.4.0. Its really the exact same steps in 5.2.

Also, there are many ways to do this. Instead of blocking Geographic regions you could only allow the ones you want to give access to.

Before beginning it might be a great idea to check out the new Fortiview feature to see what countries access your services the most. Under Fortiview- you can now see the countries tab.



Great, so in this example lets block the region of China – I know its not one of the top countries accessing my services.

First lets create the address object that we want to block. In this case I am setting the name of the address object as the country I am blocking. After creating the country object, I will create an address group call “Country blocks” add this to my firewall policy. That way in the future if I want to block Ireland, I can just add that object in the group and I am done.

Creating the address object for “China”. First go to “Policy & Objects” and create a new object.

create address

Next we will fill in the needed info, and change the address type to “Geography”.


Now lets great that group, and add the “China” object to it.


Awesome, now just one more step – creating the firewall policy to block this address group.


Press OK, move this policy to the top of all WAN-LAN or your interfaces policies. This way it gets hit before anything else.

There are more ways than 1 to do this. when allowing traffic into your VIP or policy you could instead specify only the allowed countries.



3 responses to “Blocking geographic regions in Fortigate 5.4

  1. anandprabhu762127725 July 21, 2017 at 6:59 pm

    Here is CLI commands to quickly create address objects to block geographic regions in FortiGate –

  2. reedone816 October 31, 2017 at 7:27 am

    i’m using 5.4.0, i have to isp one has little bandwidth in international internet connection.
    we use load balancing,
    i can’t find a way in policy route to route any non local internet connection to a specific isp (since i use wan load balancing).
    or is there anyway to configure it in wan load balacing?

Leave a Reply to reedone816Cancel reply