Troubleshooting Tip: FortiAnalyzer and FortiGate how to check abnormal user login with user group based firewall policy configuration

Description

This article describes how to troubleshoot FortiAnalyzer and FortiGate for abnormal user logins with user group-based firewall policy configuration.

Scope

FortiAnalyzer and FortiGate.

Solution

1. At FortiGate, check the user group-based firewall policy setting, which user group name is being used (For example: User Group = IT_Department).
   
   

   

   
   

2. At FortiGate, check the user group setting (For example: User Group = IT_Department), is include what user as members. (Eg: User = IT_User_001).
   
   

   

   
   

3. At FortiGate, go to the firewall user monitor to check how many users are currently connected.
   
   

   

   
   

4. At FortiGate, go to user events logs (add filter information), to check the related logs.

Filter information A: for the login failed scenario.

The message contains a failure in authentication.

Too many login failed attempt might need to further investigate it.

Filter information B: for the login success scenario.

Message contains succeeded in authentication.

Login successfully might need to further investigate it, if the user login is not within the usual time frame.

5. At FortiAnalyzer, go to user events logs 'Analytics Logs' (add filter information) to check the related logs.

Filter information:

Message (use ~ symbol) succeeded in authentication, or Message (use ~ symbol) succeeded in authentication.

Logs column information:

• 'Date/Time' column: to check if the user is accessing the device within the usual time frame.

• 'User' column: to check which user account is trying to log in.

• 'Source' column: to check the user is trying to access what IP address of the device.