Technical Tip: Getting alert logs frequently on FortiGate for 'SSL failed users' from the unknown public IP addresses and from different countries

On a default configuration of the SSL VPN exposed to the internet, in the logs, it is possible to see many attempts to log in to the SSL VPN.
There are many ways to cut down on these attempts; following the SSL VPN Security Best Practices guide is a good start:
SSL VPN security best practices

Generally, after implementing the suggestions seen in that article, there may still be some attempts to make.

The geo-block would still allow attempts from the country that was configured.

Usually, these leftover attempts will be coming from Tor exit nodes or other anonymous VPNs.

Following this article will allow you to use the built-in ISDB objects to block these attempts:
Technical Tip: Prevent Malicious IP addresses from accessing SSL VPN with brute-force attacks on FortiGate 

Other documents that cover restricting SSL VPN attempts:

• Restricting SSL VPN connectivity from certain countries using firewall geography addresses: Technical Tip: Restricting SSL VPN connectivity from certain countries using firewall geography addresses 
• How to limit SSL VPN login attempts and block duration: Technical Tip: How to limit SSL VPN login attempts and block duration
• Restricting/Allowing access to the FortiGate SSL VPN from specific countries or IP addresses with local-in-policy: Technical Tip: Restricting/Allowing access to the FortiGate SSL VPN from specific countries or IP addresses with local-in-policy