FortiGate topic

Local-In Policy

Control traffic destined to the FortiGate itself, such as administrative access, routing protocols, VPN negotiation and other control-plane services.

Overview

A FortiGate local-in policy applies to traffic whose destination is the FortiGate itself. It differs from a normal firewall policy, which controls traffic passing through the FortiGate between interfaces or zones.

Typical local-in traffic includes HTTPS/SSH administration, IKE/IPsec negotiation, BGP/OSPF control traffic, SNMP, DNS to the FortiGate and other services terminated on the appliance.

Local-in policy vs firewall policy

Type	Controls	Example
Firewall policy	Transit traffic through the FortiGate	User VLAN → Internet
Local-in policy	Traffic terminating on the FortiGate itself	Admin workstation → FortiGate HTTPS/SSH

Common use cases

Use case	Example
Administrative access	Allow HTTPS/SSH only from management subnets.
VPN control plane	Restrict IKE negotiation to expected peers where appropriate.
Routing protocols	Limit BGP/OSPF control traffic to known neighbors.
Monitoring	Restrict SNMP or other management protocols to monitoring systems.

CLI quick reference

show firewall local-in-policy

config firewall local-in-policy
    edit 1
        set intf "port1"
        set srcaddr "MGMT-SUBNET"
        set dstaddr "all"
        set action accept
        set service "HTTPS" "SSH"
        set schedule "always"
    next
end

Syntax and available fields can vary by FortiOS release. Validate against the administration/CLI reference for the deployed version before using in production.

Troubleshooting

Check	Why
Interface `allowaccess`	The service must still be enabled on the receiving interface when applicable.
Trusted hosts	Administrator trusted-host restrictions can block management access independently.
Policy order	Local-in policy is evaluated according to its configured sequence.
Correct interface	Match the interface on which the traffic actually arrives.
Packet capture / debug	Confirm whether the packet reaches the FortiGate and how it is handled.

Official Fortinet resources

Search Fortinet Docs for Local-In Policy ↗

Search the Fortinet documentation set for local-in policy configuration and behavior.

Official Fortinet

Search Fortinet Community ↗

Technical tips and troubleshooting discussions related to local-in policy.

Fortinet Community