Troubleshooting Tip: Reasons for failed Admin login on FortiGate or an unsuccessful login on FortiGate GUI
Description
This article describes the reasons for a failed Admin login on FortiGate or an unsuccessful login on the FortiGate GUI.
Scope
FortiOS.
Solution
This issue is observed when someone attempts to log in to the FortiGate device using administrative credentials, but the login is unsuccessful.
This could be due to various reasons, such as an incorrect username or password, or because FortiGate considered the login attempt as potentially malicious.
To narrow down the cause of the issue:
- Review the Event Log Details: Review the steps in: Technical Tip: How to check failed admin logins from the GUI and CLI to check the event log details to gather more information about the failed login attempt. Look for specific error messages or codes that might provide insights into the reason for the failure.
- Check for Malicious Activity: Multiple failed login attempts could indicate a brute-force attack or unauthorized access attempts. Investigate the source IP address of the failed login attempts. If there is a pattern of suspicious activity, take appropriate measures such as blocking the IP address or implementing additional security measures.
- Account Lockout policy: FortiGate may have an account policy configured that temporarily locks an account after a certain number of failed login attempts. Check if the administrator's account is locked and, if so, follow the appropriate procedure to unlock it.
By default, the number of password retry attempts is set to three, allowing the administrator a maximum of three attempts at logging in to their account before they are locked out for a set amount of time (by default, 60 seconds).
Check the following configuration to see the lockout options:
config system global
set admin-lockout-threshold <failed_attempts>
set admin-lockout-duration <seconds>
end
Implement Two-Factor Authentication (2FA): Enable two-factor authentication for FortiGate administrators to add an extra layer of security. This can help prevent unauthorized access even if login credentials are compromised.
In v7.4.4 and v7.2.8, go to System -> Administrators.
In case email-based MFA is configured and it's failing due to the timer expiration of the email token or the email token taking a longer time, then increase the two-factor-email-expiry timer from 60(default) to 180 or above.
config system global
set two-factor-email-expiry 300 <60 seconds default>
end
To configure this in the CLI, see: Add FortiToken multi-factor authentication.
In addition to the above troubleshooting:
Ensure that the admin account is not administratively restricted by certain session limits. If multiple administrators are sharing the same credentials, check whether the admin account has session limits configured that could be causing login issues. Refer to the following KB articles for more details:
Technical Tip: How to set a maximum number of logged-in administrators
Technical Tip: Restricting multiple admin sessions from the same admin user
Related articles:
Technical Tip: Viewing the recent admin user failed login details
Technical Tip: Recommendations and common scenarios for Administrator access on FortiGate
