Skip to main content
cnote12
cnote12
New Member
March 2, 2023
Question

SSLVPN bad logins are increasing and with office username

  • March 2, 2023
  • 2 replies
  • 1166 views

Hi!

We are using MFA for SSL VPN. I can see now that bad actors are using our internal users name to try login to SSL VPN. They use proxy addresses from US. UK, Germany etc so blocking of geographic location is not possible as its not coming from some problematic countries.

I have see couple of posts that people are using some external connectors to block IP addresses based on its reputation.

If someone can point me to a documentation of how to setup some external connector and which service is best to buy for IP reputation.

How many of you such solution and if there are cons to it?

 

Thanks

2 replies

Yurisk
SuperUser
Yurisk
SuperUser
March 2, 2023

Hi, 

is there anything common for those attackers IPs? Like coming from VPN/Anonymizers/etc ?

If there is then you could address it with Fortigate ISDBs more effectively/targeted as opposed to general threat feeds.

 

Regards to external feeds, technically Fortigate works excellently with them, but as to their effectiveness ... I haven't watched them closely, but when used for clients, seemed to me more of psychological help - to calm a bit admins that they have something in place. I don't recall anything being blocked by them. But of course it will differ based on the quality of those feeds. I can't comment on specific ones as haven't formed an opinion on them.

ANd there are no cons to using them as FGTs of last few years don't add any visible load on using those feeds. 

Specifically in the context of SSL VPN - you can use external feeds in Local-in policies, but starting with 7.2.4 only, or you can use them in regular Security rules, provided you move SSL VPN to listen on Loopback/internal (not WAN) interface. You cannot use feeds directly in VPN SSL Settings even today, yet.

 

How to configure: https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/9463/threat-feeds 

 

yurisk.info - all things Fortinet blog, no ads
gfleming
Staff
gfleming
Staff
March 2, 2023

You can enable automatic blocking of IP addresses that are trying brute force logins.

 

config vpn ssl settings
  set login-attempt-limit 2  <--number of bad login attempts
  set login-block-time 60    <--length of time in seconds to block IP for (up to 24 hours)
Terms & ConditionsAccessibility statement