Explorer III

Solved

Many SSL-VPN login failed attempts! What to do?

Forum|Forum|1 year ago
September 27, 2024
6 replies
5818 views

Hello everybody,

I've a problem in my network with my FortiGate.

I've a simple SSL-VPN (web mode is disabled) whose access is restricted to italian and albanian addresses:

Screenshot 2024-09-27 alle 14.12.57.png

The problem is that there are many connection attempts, and each of these attempts has a different IP address:

date=2024-09-27 time=12:27:33 id=7419267613974331394 itime="2024-09-27 12:27:34" euid=5123 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="abl0000" remip=87.4.68.245 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_unknown_user" eventtime=1727432853997409279 tz="+0200" devid="FGT60FTK23099PH2" vd="root" dtime="2024-09-27 12:27:33" itime_t=1727432854 devname="ntd-fg"

date=2024-09-27 time=12:16:21 id=7419264723461341184 itime="2024-09-27 12:16:21" euid=4699 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="empty" remip=79.55.254.104 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_unknown_user" eventtime=1727432181240072200 tz="+0200" devid="FGT60FTK23099PH2" vd="root" dtime="2024-09-27 12:16:21" itime_t=1727432181 devname="ntd-fg"

date=2024-09-27 time=12:12:23 id=7419263701259124737 itime="2024-09-27 12:12:23" euid=5122 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="en_nabba" remip=95.251.127.145 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_unknown_user" eventtime=1727431943656373820 tz="+0200" devid="FGT60FTK23099PH2" vd="root" dtime="2024-09-27 12:12:23" itime_t=1727431943 devname="ntd-fg"
date=2024-09-27 time=12:05:59 id=7419262051991683075 itime="2024-09-27 12:05:59" euid=5121 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="dispo2" remip=185.168.97.3 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_unknown_user" eventtime=1727431559335347359 tz="+0200" devid="FGT60FTK23099PH2" vd="root" dtime="2024-09-27 12:05:59" itime_t=1727431559 devname="ntd-fg"

date=2024-09-27 time=10:29:36 id=7419237214195810305 itime="2024-09-27 10:29:36" euid=5120 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="abrechnung" remip=188.12.223.155 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_unknown_user" eventtime=1727425776595975939 tz="+0200" devid="FGT60FTK23099PH2" vd="root" dtime="2024-09-27 10:29:36" itime_t=1727425776 devname="ntd-fg"

I suppose these are brute force attacks, so I think that they will never succed. But what can you do in this kind of situations? The IP BAN is not a solution, because as you can see, each time the attacker uses a different IP address.

What's the solution?

Thank you so much!

Best answer by pminarik

If your users are well educated to use good non-trivial passwords and use 2FA, then blind brute-force attempts are just noise in logs that's extremely unlikely to succeed.

For additional hardening you can add client-certificate requirements to authentication, move SSL-VPN to an unusual port, start blocking bigger IP blocks (/24? bigger? be careful with this), or consider moving off SSL-VPN to IPsec, which is a much less juicier target than the HTTPS-based SSL-VPN login.

pminarikAnswer

Staff

If your users are well educated to use good non-trivial passwords and use 2FA, then blind brute-force attempts are just noise in logs that's extremely unlikely to succeed.

For additional hardening you can add client-certificate requirements to authentication, move SSL-VPN to an unusual port, start blocking bigger IP blocks (/24? bigger? be careful with this), or consider moving off SSL-VPN to IPsec, which is a much less juicier target than the HTTPS-based SSL-VPN login.

arahman

Staff

Hi, you can block the countries you are not interested to not have access over the ssl vpn port,

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-by-country-or-geolocation/ta-p/196741

or you can also block the users IP trying to do the login attempt and failing automatically

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-permanently-block-SSL-VPN-failed-logins/ta-p/287171#:~:text=Use%20the%20Address%20Group%20to,negate%20in%20SSL%2DVPN%20settings.&text=Method%202%3A%20Create%20a%20Deny,in%20the%20Source%20Address%20field.

sjoshi

Staff

Hi you can also setup local in policy to block traffic from certain region which you do not want to allow access.

Refer:-

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/363127/local-in-policy

Thanks, Salon

salmas

Staff

Hello @raffaeledp

You can refer to best practice guide for SSL VPN.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-SSL-VPN-best-practices-guide/ta-p/331260

salmas

vbandha

Staff

Hi @raffaeledp

When you configure 'Limit access to specific hosts' it will still generate logs for the VPN attempts for the blocked countries. The attacker will not be allowed access if they are from blocked country even if they enter the correct username and password.

If you would like to not see the logs, you can setup local in policy:
https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/363127

Having MFA would provide a good security against such attacks.

Here are some other hardening suggestions for SSL VPN:

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/947829/ssl-vpn-security-best-practices

Regards,

Varun

pmudgal

Staff

Hello RDP,

Thank you for reaching out fortinet support.

From the logs it looks like unknown users are trying to access your VPN Service.

In order to secure your network please refer the below articles: