Block SSLVPN login

Hey Can,

I'm a little unclear what exactly you're looking for:

- do you want the FortiGate to only generate a log for users it knows?

--> this is not really possible, but you could filter out failed SSLVPN logs

--> those logs would have a specific log ID, and you can set a filter via CLI to exclude those logs

--> most failed SSLVPN logs will not contain a username, as VPN can often fail before authentication is completed successfully, and username information is not applicable due to this

- do you want FortiGate to block/drop connections for anyone except known users?

--> this is not possible because FortiGate will only learn the username after successful authentication, which requires allowing an initial connection.

You could try changing the SSLVPN port - that would require your VPN users to make a minor change on their FortiClients, but should help somewhat, unless the ports of your FortiGate are scanned for some reason and the new VPN port discovered, and FortiGate can be configured with DoS policies to block port scans.

config firewall addres. edit "Block_SSLVPN" ...config vpn ssl setting. set source-address "Block_SSLVPN" ...dia sniff pack any "host 10.47.2.111 and port 10443" 4. Using Original Sniffing Mode. ... get vpn ssl monitor. SSL-VPN Login Users  myfiosgateway.com

mobdro

We've seen similar issues with increasing brute-force attempts on SSLVPN logins. One effective approach is to implement multi-factor authentication (MFA), which significantly reduces unauthorized access attempts. Additionally, you can configure failed login attempt thresholds to temporarily block repeated failures from unknown usernames, which helps keep your logs clean.

Another option is dynamic allowlisting, where only pre-approved devices can initiate VPN connections. If your FortiGate supports it, using certificate-based authentication alongside username-password login can further strengthen security.

For managing network security and optimizing firewall settings, we found this comprehensive guide on MyFiosGateway myfiosgateway.com particularly helpful in setting up secure remote access configurations. You might find some useful insights there!