Explorer

Question

Administrator admin logged in successfully from https(127.0.0.1)

5 replies
4846 views

Fortigate 60D(v6.0.13) and FortiAnalyzer(v7.2.5)

I'm having strange issue, Fortigate dashboard show two admins logged in - Admin (with my workstation ip ) and Admin (127.0.01).

FortiAnalyzer system events for FGT60D show the following. Every hour there is a successful login.

14:57:45 Administrator admin timed out on https(127.0.0.1) 14:47:46 Administrator admin logged in successfully from https(127.0.0.1) 13:57:22 Administrator admin timed out on https(127.0.0.1) 13:48:19 Administrator admin logged in successfully from https(127.0.0.1)

I have other devices with older and newer firmware, not seeing this issue for other devices, including 60D with older firmware.

Any idea what is causing this and how to resolve this ?.

Thanks.

Shashwati

Staff

Hello,

Please refer to the document regarding 127.0.0.1 Admin login

https://community.fortinet.com/t5/FortiAnalyzer/Technical-tip-Admin-login-from-127-0-0-1/ta-p/191892

ebyAuthor

Explorer

Hello,

on FAZ, correct username and password are configured.

on FGT following is configured,

config log fortianalyzer setting     set status enable     set server <FAZ_IP>     set enc-algorithm high-medium     set certificate "Fortinet_Factory"     set upload-option 1-minute     set reliable enable end

there is no "set serial" command available on FGT as per the document shared by you.

SonaMuvv

Staff

Hello,

Please run the following command

config log fortianalyzer setting

sh full

end

This sh full configuration will show the set serial command

https://docs.fortinet.com/document/fortigate/6.4.8/cli-reference/465620/config-log-fortianalyzer-setting

AlexC-FTNT

Staff

Technically it's not a problem to solve. It's normal behavior when FAZ polls information from that firewall. In some (older) versions it is shown in the logs, in others it is not. In the newer FortiOS this log was removed. The only concern you should have is when you see failed attempts from FAZ IP and admin account.

How to remove these logs? Try to filter them in FortiGate or FAZ by log ID and exclude them. Make sure you don't exclude valid logs too with this filter.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-exclude-a-specific-set-of-logs-that-is-sent/ta-p/265525

Sign up

Login with SSO

Login to the community

Login with SSO