Admin login from 127.0.0.1 issue

Forum|Forum|7 years ago
November 7, 2018
1 reply
21758 views

I have been trying to fiugure out what is causing this message in the event logs, there is one every 15 minutes

Administrator admin login failed from http(127.0.0.1) because of invalid password

Now the source is 127.0.0.1, meaning the firewall itself, but I cannot find anything that would be causing it, there was a old script setup to backup the config, deleted the script but still get the message, so it was probably not the backup script, anything else I could check?

I did go through the config and searched for "admin" but nothing in there that would use that username to try and log in

Capture.JPG

Best answer by Hosemacht

Hello there,

please have a look at thread : https://forum.fortinet.com/tm.aspx?tree=true&m=166591&mpage=1#

Regards

ShawnZAAuthor

New Member

Seems it was the Analyzer causing it, still not sure why it would show source as 127.0.0.1

le0

New Member

Hello,

I've exactly the same issue.

Login/password from analyser to fortigate are OK.

I've tried to reapply it on the Analyzer (device manager > device > Edit) but nothing change.

When I configure a test login/password on the Analyzer (device manager > device > Edit), I can see the failed authent with this test login so I can confirm this issued is caused by the Analyzer. But why failed authent with correct login/password ..??