sslvpn_login_permission_denied

Hi. 

I am adding the results below.

# get vpn ssl monitor
SSL-VPN Login Users:
Index User Group Auth Type Timeout Auth-Timeout From HTTP in/out HTTPS in/out Two-factor Auth

SSL-VPN sessions:
Index User Group Source IP Duration I/O Bytes Tunnel/Dest IP

# diagnose firewall auth list

----- 0 listed, 0 filtered ------

# dia vpn ssl statistics
SSLVPN statistics (root):
------------------
Memory unit: 1
System total memory: 2011013120
System free memory: 756207616
SSLVPN memory margin: 201101312
SSLVPN state: normal

Max number of users: 2
Max number of tunnels: 2
Max number of connections: 21

The number of invalid_http: 797

Current number of users: 0
Current number of tunnels: 0
Current number of connections: 0

# exec vpn sslvpn list
SSL-VPN Login Users:
Index User Group Auth Type Timeout Auth-Timeout From HTTP in/out HTTPS in/out Two-factor Auth

SSL-VPN sessions:
Index User Group Source IP Duration I/O Bytes Tunnel/Dest IP

# get system status
Version: FortiGate-60F v7.2.10,build1706,240918 (GA.M)
Security Level: 2
Firmware Signature: certified
Virus-DB: 92.09284(2024-12-04 04:26)
Extended DB: 92.09284(2024-12-04 04:25)
AV AI/ML Model: 3.02027(2024-12-04 03:45)
IPS-DB: 29.00914(2024-12-03 06:23)
IPS-ETDB: 0.00000(2001-01-01 00:00)
APP-DB: 29.00914(2024-12-03 06:23)
FMWP-DB: 24.00111(2024-11-06 13:21)
INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
IPS Malicious URL Database: 5.00251(2024-12-03 06:59)
IoT-Detect: 0.00000(2022-08-17 17:31)
Serial-Number: -
BIOS version: 05000009
System Part-Number: P24286-07
Log hard disk: Not available
Hostname: AIRPLUS
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 1706
Release Version Information: GA
System time: Wed Dec 4 16:15:36 2024
Last reboot reason: warm reboot

# diag vpn ssl stat
SSLVPN statistics (root):
------------------
Memory unit: 1
System total memory: 2011013120
System free memory: 765112320
SSLVPN memory margin: 201101312
SSLVPN state: normal

Max number of users: 2
Max number of tunnels: 2
Max number of connections: 21

The number of invalid_http: 797

Current number of users: 0
Current number of tunnels: 0
Current number of connections: 0

# diag sys flash list
Partition Image TotalSize(KB) Used(KB) Use% Active
1 FGT60F-7.02-FW-build1706-240918 253920 140428 55% Yes
2 FGT60F-7.02-FW-build1396-230131 253920 150012 59% No
3 ETDB-92.09284 3102320 416784 13% No
Image build at Sep 18 2024 18:23:21 for b1706

# diag debug enable

AIRPLUS # 2024-12-04 16:19:37 local auth is done with user 'ylim', ret=1
2024-12-04 16:19:38 local auth is done with user 'paulcv', ret=1
2024-12-04 16:20:20 [2507] handle_req-Rcvd auth_cert req id=2006890860, len=1599, opt=8
2024-12-04 16:20:20 [983] __cert_auth_ctx_init-req_id=2006890860, opt=8
2024-12-04 16:20:20 [992] __cert_auth_ctx_init-OCSP resp is found.
2024-12-04 16:20:20 [103] __cert_chg_st- 'Init'
2024-12-04 16:20:20 [156] fnbamd_cert_load_certs_from_req-3 cert(s) in req.
2024-12-04 16:20:20 [669] __cert_init-req_id=2006890860
2024-12-04 16:20:20 [718] __cert_build_chain-req_id=2006890860
2024-12-04 16:20:20 [273] fnbamd_chain_build-Chain discovery, opt 0x19, cur total 1
2024-12-04 16:20:20 [291] fnbamd_chain_build-Following depth 0
2024-12-04 16:20:20 [336] fnbamd_chain_build-Extend chain by builtin CA cache. (good)
2024-12-04 16:20:20 [291] fnbamd_chain_build-Following depth 1
2024-12-04 16:20:20 [336] fnbamd_chain_build-Extend chain by builtin CA cache. (good)
2024-12-04 16:20:20 [291] fnbamd_chain_build-Following depth 2
2024-12-04 16:20:20 [305] fnbamd_chain_build-Self-sign detected.
2024-12-04 16:20:20 [99] __cert_chg_st- 'Init' -> 'Validation'
2024-12-04 16:20:20 [840] __cert_verify-req_id=2006890860
2024-12-04 16:20:20 [841] __cert_verify-Chain is complete.
2024-12-04 16:20:20 [435] fnbamd_builtin_cert_check-Following cert chain depth 0
2024-12-04 16:20:20 [435] fnbamd_builtin_cert_check-Following cert chain depth 1
2024-12-04 16:20:20 [456] fnbamd_builtin_cert_check-Builtin CRL found: 244b5494
2024-12-04 16:20:20 [435] fnbamd_builtin_cert_check-Following cert chain depth 2
2024-12-04 16:20:20 [471] fnbamd_builtin_cert_check-Certificate status is unchecked.
2024-12-04 16:20:20 [876] __cert_verify_do_next-req_id=2006890860
2024-12-04 16:20:20 [99] __cert_chg_st- 'Validation' -> 'OCSP-Checking'
2024-12-04 16:20:20 [898] __cert_ocsp_check-req_id=2006890860
2024-12-04 16:20:20 [334] fnbamd_verify_ocsp_response-Cert status: GOOD.
2024-12-04 16:20:20 [256] __cert_ocsp_resp_verify-verify_ocsp_response returns 0 -1
2024-12-04 16:20:20 [99] __cert_chg_st- 'OCSP-Checking' -> 'Done'
2024-12-04 16:20:20 [921] __cert_done-req_id=2006890860
2024-12-04 16:20:20 [1683] fnbamd_auth_session_done-Session done, id=2006890860
2024-12-04 16:20:20 [966] __fnbamd_cert_auth_run-Exit, req_id=2006890860
2024-12-04 16:20:20 [1720] create_auth_cert_session-fnbamd_cert_auth_init returns 0, id=2006890860
2024-12-04 16:20:20 [1639] auth_cert_success-id=2006890860
2024-12-04 16:20:20 [1068] fnbamd_cert_auth_copy_cert_status-req_id=2006890860
2024-12-04 16:20:20 [1195] fnbamd_cert_auth_copy_cert_status-Cert st 210, req_id=2006890860
2024-12-04 16:20:20 [209] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 2006890860, len=2536
2024-12-04 16:20:20 [1584] destroy_auth_cert_session-id=2006890860
2024-12-04 16:20:20 [1041] fnbamd_cert_auth_uninit-req_id=2006890860
2024-12-04 16:20:43 local auth is done with user 'fgordon', ret=1
2024-12-04 16:20:46 local auth is done with user 'ndempsey', ret=1

# diag debug disable

# diag debug reset

run 

diag sniff packet any 'host x.x.x.x' 4 0 l >> Here x.x.x.x is the public IP of the user

And then try to connect vpn

this will clear if the traffic is coming to the FGT or not

I created local users to make SSL VPN. There is an error while making SSL VPN. I wrote above actually.

""Hello,

I have Fortinet 60 F device. An error showed up while trying to connect via SSLVpn that too many bad login attempts.-455 . When I check firewall failed authentication parts I saw that there are a lot of attempts to login. I am adding the screenshot. What can I do as an emergency solution? Thanks in advance.""

Are this user cfish validate user? which auth is failing