AuthCodes Flooding Email Since Upgrading to 5.6.0

6 replies
5895 views

Since upgrading my FortiAnalyzer 200D to v5.6.0, I am being flooded with AuthCode emails. My FortiGates are configured with 2 factor authentication enabled.

chall_FTNT

Staff

If the e-mails you are referring to are e-mail alerts sent by the FAZ, then they would be triggered by logs sent by your FortiGates. Can you provide output of one of the log messages triggering that e-mail alert?

The question is then whether that alert message *ought* to be triggered by the logs in question, depending on how you have configured it. You can increase the threshold for that alert to ensure less frequent e-mails. But ultimately, you should probably address the reason why the FortiGates were sending the logs. Ultimately, the only thing your FAZ upgrade might have done is make the event handler more sensitive.

CHoodAuthor

New Member

These are authentication code emails sent from the FortiGates. We use the legacy email-based 2 factor authentication. It appears that the FortiAnalyzer is triggering these emails when it connects to the FortiGates. This is happening about every few seconds.

I think I've come up with a workaround by creating a separate user account without 2FA enabled on the FortiGates for the FortiAnalyzer to use. I've restricted login to the address of the FortiAnalyzer.

chall_FTNT

Staff

Glad you found a workaround.

When you refer to "FortiAnalyzer" (FAZ), perhaps you are referring to a FortiManager (FMG), perhaps which has FortiAnalyzer features enabled. A FMG will attempt to login to FGT (for configuration management). A FAZ (logging/reporting) will not.

Sign up

Login with SSO

Login to the community

Login with SSO