Skip to main content
Tutek
Tutek
New Member
May 8, 2023
Question

Forticlient SSL VPN failed login limit

  • May 8, 2023
  • 1 reply
  • 7809 views

Hello,

how could I set limit for failed logins using Forticlient in SSL Mode.

Now I have such settings:

FGT (settings) # show full-configuration  config vpn ssl settings     set login-attempt-limit 2     set login-block-time 60

but no matter of that I can login how many time I like in forticlient and every time it return me that password is incorrect, then on the 10th time I use correct password and can login - so blocking is not working.

1 reply

srajeswaran
Staff
srajeswaran
Staff
May 8, 2023

Can you please confirm if you are trying to login from same client IP and login attempts are made within 30 seconds?

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-timers-explanation-and-SSL-VPN-Login/ta-p/203615

chauhans
Staff
chauhans
Staff
May 8, 2023

Hi @Tutek 

You may also look into the below doc. Hope it will help you out.
Limit the count of failed login attempts until the user is banned:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-limit-SSL-VPN-login-attempts-and-block/ta-p/194229?externalID=FD48714

>>Restrict the source IP address area
If your users only need access to the SSL VPN portal from a specific source address or range, you can limit the allowed source addresses to those addresses.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-by-country-or-geolocation/ta-p/196741

Also, please run the below commands in the CLI and then try to connect to VPN, post that logs will be generated, please share me those logs.

diag debug reset 

diagnose vpn ssl debug-filter src-addr4

diag debug appl sslvpn -1

diag debug enable

 





Tutek
TutekAuthor
New Member
May 8, 2023

where I could check on CLI or GUI if user is blocked or not?

Terms & ConditionsAccessibility statement