Skip to main content
Tutek
Tutek
New Member
June 1, 2026
Question

Notification failed user login for dialup ipsec connection

  • June 1, 2026
  • 6 replies
  • 115 views

Hi,

is any way to configure failed user login notification for dialup ipsec connection?

For the ssl vpn failed login there is dedicated trigger name “SSL VPN login fail, ID 39426” and this is working fine, but I don’t have any similar for dialup Ipsec.

This notification should only notify about wrong user password entered no matter is it authenticated using remote radius or this is local account on fortigate.

I'm not interested in a log that reports the status of the phase1 as “failure,” because I have many other site-to-site IPsec tunnels, and that would cause confusion.

Thanks.

 

6 replies

msanjaypadma
Staff
msanjaypadma
Staff
June 1, 2026

Hi ​@Tutek ,

You use the filters in automation stich for specific Dialup tunnel. 
Refer below article: 


If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

Thanks,
Mayur Padma

Thanks, Mayur Padma
    Tutek
    TutekAuthor
    New Member
    June 1, 2026

    Yes, I know that Field Filters can be used, but what fields should be used in this case Xauth field?

    When I enter a bad password during a connection then in VPN event log I have this:

    User    VPN-Users
    Group    N/A
    XAUTH User    user01
    XAUTH Group    N/A

    Action    negotiate
    Status    failure
    Result    N/A

    Log event original timestamp    1780304057778508800
    Timezone    +0200
    Log ID    0101037121
    Type    event
    Sub Type    vpn
    Alternate User    N/A
    Peer Notification    NOT-APPLICABLE
    ADVPN Shortcut    0

    msanjaypadma
    Staff
    msanjaypadma
    Staff
    June 1, 2026

    Hi ​@Tutek ,


    Can you check with this : 
     

                         name : "result"

                        value : "XAUTH authentication failed"

    If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.


    Thanks,
    Mayur Padma

    Thanks, Mayur Padma
      msanjaypadma
      Staff
      msanjaypadma
      Staff
      June 1, 2026

      Hi ​@Tutek ,

      Can you check with this filters:

      name : "result"
      value : "XAUTH authentication failed"

      If you have found a solution, please like and mark it as solved to make it easily accessible for everyone
      .
      Thanks,
      Mayur Padma

      Thanks, Mayur Padma
        Tutek
        TutekAuthor
        New Member
        June 1, 2026

        edit "IPSEC VPN login fail"
                set event-type event-log
                set logid 37121
                config fields
                    edit 1
                        set name "result"
                        set value "XAUTH authentication failed"
                    next
                end

        In this case I don’t get any notification email.

        msanjaypadma
        Staff
        msanjaypadma
        Staff
        June 1, 2026

        Hi ​@Tutek ,

        I can able to see in my lab the log information about auth failed. Refer below logs : 


        Can you check from the same system whether authorized user is able connect to VPN and below logs are generated ? This will confirm, that you  have correct VPN configuration and reachability with FortiGate and logs are getting generated. 


        I have configured ikev1 with aggressive mode in lab setup.  Can confirm what is the configuration ? all logs ?

        Thanks,

        Mayur Padma

        Thanks, Mayur Padma
        Tutek
        TutekAuthor
        New Member
        June 1, 2026

        I use IKEv2, as the “Result” of bad password entered I have N/A.

        My tunnel is working fine if I enter correct password, then I get an connection.

         

        msanjaypadma
        Staff
        msanjaypadma
        Staff
        June 1, 2026

         Hi ​@Tutek ,

        I have checked with v7.6.6 + IKEv2 , firewall only generate the VPN result + user information logs only for successful login event , not for the wrong credentials. However it does only work for IKEv1.
         


        If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

        Thanks,
        Mayur Padma

        Thanks, Mayur Padma
          Tutek
          TutekAuthor
          New Member
          June 2, 2026

          Ok, understood this is not possible. That's seems odd, it's better to monitor failed logins to see if there are any attempted attacks than to monitor successful logins. I hope they'll add that feature in the future. 

          Terms & ConditionsAccessibility statement