New Member

Question

Automatic blocking IP to prevent Fortigate web interface login page

Forum|Forum|2 years ago
July 26, 2023
7 replies
45376 views

Hi,

Last few days I started to see new activity on my WAN link - many login attempts on HTTPS interfaces of my Fortigates. In majority they come from IP: 185.253.160.140 but not exclusevily. My question is how to automatically block these attempts, i.e. to ban certain IP from viewing login page of Forti after few unsuccessfull login trials.

I have few Fortigates with soft not older than 6.2.15.

Piotr

FortiGate

Bjay_Prakash_Ghising

Explorer II

Hi pszewczyk

Apply the given command to the CLI Script of the action field.

diagnose user banned-ip add src4 %%srcip%% 0 admin

If that doesn't resolve then create a group and append it to the local-in policy.

To Create and append addresses to the group, you can find the attached link.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-and-append-addresses-into-address-groups/ta-p/261701

https://community.fortinet.com/t5/Support-Forum/Automation-SSL-VPN-login-fail-event-gt-Ban-IP/m-p/265099#M216649

Hope that helps,

Kind Regards,

Bijay Prakash Ghising

Ckden

New Member

Fortigate FGT60E
Would you happen to know why the ip address does not add to list?
I can add one manually.
I see a delete result happening for some reason. I have no idea where to look for this auto delete.

General

Last Access Time	12:07:12
VDOM	root
Log Description	Autoscript stop automatically

Event

Message

script autod.75 stopped automatically

General

Last Access Time	12:07:12
VDOM	root
Log Description	Autoscript delete result

Action

delete_result

Event

User Interface	autod
Message	User delete the result of script autod.75 from autod

hazim

Staff

Hi @pszewczyk,

Based on my understanding you want to block any specific IP to your FortiGate interface. You can create a local-in policy to block specific IPs reaching your FortiGate interface. You may refer to the KB below for more information:-

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/363127/local-in-policies

Best Regards,

Hazim

Emma02

Visitor III

To automatically block IP addresses and prevent unauthorized access to the Fortigate web interface login page, you can implement a security policy using the built-in features of the Fortigate. Here's a concise solution:

Log in to your Fortigate web interface.
Go to "Security Profiles" and create a new "DoS Policy".
Set "DoS Policy Type" to "HTTP Login Protection".
Configure "HTTP Login Protection Settings" to specify the number of allowed login attempts and the duration of the block.
Apply the policy to your WAN-facing interface.

For more detailed instructions and further assistance, visit Fortinet's official website at https://www.fortinet.com/support./devops training https://www.fortinet.com/support./

I hope this will help you.

saneeshpv_FTNT

Staff

Hi,

Firstly, its not a best security practice to allow HTTPS/SSH on the WAN interface of FortiGate. So I would recommend you to disable HTTPS/HTTP/SSH and other Services on the WAN Interface.

Even after disabling the service on the WAN interface and you still see some traffic reaching your WAN and effecting the system performance, you may apply other recommendations mentioned here.

Best Regards,

AFT

Visitor III

What about the SSL VPN web interface? You can't disable that on the WAN interface when it's required to establish remote connections. @pszewczyk is correct, FortiGate needs to include a way to auto-ban bad login attempts over long periods of time...say 3 from the same IP in 24 hours.

AFT

Visitor III

I am using local-in-polices and have three interfaces to protect, WAN1, WAN2, and the SSLVPN port. (SSLVPN isn't really an interface but needs to be called out specifically from what I have seen.) I still see bots attempting to log in at a very slow rate. I am looking a way to auto-ban bad login attempts over long periods of time...say 3 attempts from the same IP in 24 hours.

AEK

SuperUser

I think disabling web access (and any other admin access) on WAN interface is not only a good security practice but a must practice. I also usually see some companies disable even ping, which makes sens since sanner bots usually start by pinging your IP before scanning ports.

For SSL VPN I think it is good security practice to use non standard high port, cause most scanner bots never go above one or few thousand first ports.

AEK

AFT

Visitor III

Bots don't care about the port number. We run the port in the 10K range and it gets probed a lot, daily. The SSLVPN login page is a HTTP based page. The point here is that you cannot disable the web GUI page for SSLVPN so even if you remove HTTP(S) and SSH management on the WAN interfaces, you still have an open HTTP(S) page published to the world regardless of the port number. Check your System Events and filter it by VPN event. If you have SSLVPN configured, it will be an eye opener for you.

AEK

SuperUser

Here are some ideas to make your SSL VPN more secure:

Enable MFA
Disable Web mode
Use high non standard port
Give access to the minimum required resources
Keep your FG patched
Restrict access by IP or GeoIP if possible

AEK

Bjay_Prakash_Ghising

Explorer II

I apologize for the inconvenience caused by my repeated replies.

It seems there might be a limit or a bug in the system, as my responses were not visible. The response numbers are increasing, but replies to the most recent post are not displaying.

I'm unsure whether this response has been successfully posted. If anyone sees this response, please report the bug to the admin.

Thank you in advance for your assistance.

Bjay_Prakash_Ghising

Explorer II

Hi @AFT @AEK

As far as I know,

Banning IP addresses won't affect the administrative access to the GUI login page. Instead, it simply blocks services passing through the FortiGate.

To enforce administrative restrictions, you must configure a local-in policy or set up trusted hosts.

If you wish to automate such a capability, you must establish specific criteria to trigger the automation. You can take a reference from the below articles and create your criteria(Trigger)

- https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-and-append-addresses-into-address-groups/ta-p/261701

- https://community.fortinet.com/t5/Support-Forum/Automation-SSL-VPN-login-fail-event-gt-Ban-IP/m-p/265099#M216649

Without such automated settings, it's unlikely that any security appliance will automatically block IPs attempting to access your publicly hosted services. Blocking administrative access without validation checks is not feasible.

Think of it, how would a security appliance block the IPs in such a case?

Security appliances need to perform validation checks, such as C&C, P2P botnet, IP Reputation, Compromised hosts, and Threat level, for effective blocking or allowing of connections. Even for those detections to work, IPs need to pass through the Firewall policy.

Configuring best practices is one way to limit threats. However, for total blocking of GUI administrative access on FortiGate, you need to automate IP blocking in the local-in policy.

When configuring such settings globally, consider false positive attempts as well.

config vpn ssl settings
set login-attempt-limit x (default=2)
set login-block-time x (default=60, max=86400)

config system global
admin-lockout-threshold x (default=3)
admin-lockout-duration x (default=60, max=2147483647)

I hope this information is helpful.

Kind Regards,
Bijay Prakash Ghising

Sign up

Login with SSO

Login to the community

Login with SSO