Skip to main content
jinto26
jinto26
New Member
July 23, 2022
Question

SSL VPN Logging & Brute Force Attacks

  • July 23, 2022
  • 3 replies
  • 16588 views

Hey everyone, I have a customer who is constantly being attacked on our SSL VPN interface. I enabled block policies after 3 failed attempts and they get blocked for 6 months. It worked well for a little while but now they are using spoofing to change their IP every attempt. So rendering my blocking useless. I wouldn't care so much but I am constantly getting failed login attempt alerts emails now. Super annoying. I've gotten 5 since I've started writing this. Anyway, anyone see any way that I could stop this from happening? I would like to keep the logging on as its useful for me but I am thinking about just turning it off completely as this point.

    3 replies

    BK_Bianko
    BK_Bianko
    Visitor III
    July 24, 2022

    Just to say that we have been experiencing the same for more than one month. Dozens alerts each hour. It's really annoying.

     

    Francesco

    subramanis
    Staff
    subramanis
    Staff
    July 24, 2022

    Hi BK_Bianko/jinto26,

    Thank you for contacting Fortinet Forum

     

    I think this might resolve your problem, Please check the below document

     

    Restrict access to the SSLVPN service from expected country https://kb.fortinet.com/kb/documentLink.do?externalID=FD48235#:~:text=Go%20to%20VPN%20%2D%3E%20SSL%2D,connect%20to%20the%20SSL%2DVPN.


    Along with the limitation of the connections from abroad, you might follow this KB https://kb.fortinet.com/kb/documentLink.do?externalID=FD48714 and configure SSLVPN login limits along with the blocking duration of incorrectly entered credentials.


    To hide FortiGate login page using local-in-policy https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-hide-FortiGate-login-page-using-local-in/ta-p/209505


    Thanks
    Sasikumar.S

      rreinsch
      rreinsch
      Explorer
      September 15, 2022

      Restrict access to the SSLVPN service from expected country worked like a charm. Can't believe I didn't think of that.  Thanks!

      IbraMass
      IbraMass
      New Member
      February 6, 2024

      @jinto26 
      Were you able to block these attempts on an IP Level or user level ?
      I am aware of the blocking on a user level. However, If some actors try random users, is there a way to block their IP's ? I have implemented the limit of IP's from "VPN Settings" but was thinking if there is another way to even do the blocking for these allowed countries as well. 

      Terms & ConditionsAccessibility statement