Best strategy to block brute-force login attempts on Management Interface?
Hello Fortinet Community,
I would like to share a scenario we are facing with a customer's FortiGate 40F (v7.2.13) and seek your advice on the best security strategy to implement.
The Situation: We are seeing persistent and constant "Admin login failed" events in our logs. These are brute-force attempts targeting the WebGUI from various IP ranges and multiple countries.
Current Approach: So far, my mitigation strategy has been:
Creating Address Objects (Type: Subnet) for each attacking IP range.
Grouping them into an Address Group.
Applying a Local-In Policy to drop traffic from that group:
This has turned into a "cat and mouse" game. As soon as I block one range, new ones appear. I considered Geographical Blocking, but it feels too aggressive since many attacking IPs originate from the USA, and I am concerned about inadvertently blocking essential services or legitimate traffic.
I also researched this Technical Tip: Technical Tip: Block FortiGate Administrator Login with an automated script
However, the bots seem coordinated enough to pace their attempts, often avoiding the thresholds that trigger automated lockout scripts.
Also, the admin interface has to be open to internet because we need to access without the VPN.
What would be the most effective and professional strategy to stop these login attempts?
Thank you in advance!