Skip to main content
ioshakshay289
New Member
September 4, 2024
Solved

logs in system event in FortiGate firewall about Admin login failed

  • September 4, 2024
  • 3 replies
  • 2156 views

Getting logs in system event in FortiGate about "Admin login failed" and showing ip of the (Server connected to the internal network) as the source ip what to do? Is disabling SSH will work for it. or SNMP will work. Please suggest what solution we can do?

Best answer by rosatechnocrat

source - 192.168.1.5 is the source that is trying to loging to Fortigate. Please check why this source is logging and also all the login failed. so may be some script or tools using wrong password. 

3 replies

rosatechnocrat
Explorer III
September 4, 2024

This means that some program or human is trying to login to firewall from that particular server. 

 

1> Check which program or person trying login ? 

2> Verify if he is using correct credentials ? 

3> If you don't want to login to the firewall from that server, Add trusted host configuration under the admin users. 

 

For more details about trusted host and configuring security for admin users, visit the below link. 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-System-administrator-best-practices/ta-p/189413

 

 

Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
ioshakshay289
New Member
September 4, 2024

Screenshot 2024-09-04 115404.pngHi rosatechnocrat,

 Its showing only Server ip as source IP unable to capture any user IP logs Screenshot 2024-09-04 101837.png 

rosatechnocrat
Explorer III
September 4, 2024

source - 192.168.1.5 is the source that is trying to loging to Fortigate. Please check why this source is logging and also all the login failed. so may be some script or tools using wrong password. 

Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!