Unauthorized user attempt

A few things I could recommend if you don't want to disable ssh/https access from your WAN port:

1. Change the port numbers for HTTPS (443) and SSH (22) from the default ones

2. Use 2 factor authentication for all the admin logins (the FortiGate comes with two free mobile tokens)

3. If you know the IP address that you'll be connecting from for the admin access, then add these to the trusted hosts (configured under each administrator account)

I have used the restrict IP functionality of admin accounts and even changed ports but I grew tired of unknown people attempting to login anyway (using common names like "root"). Normally the IP restrictions would prohibit all untrusted IPs from even connecting but I always used a dummy user with no IP restrictions so that the administrative services would still be open because I wanted PING to work.  (I've often wished PING could be controlled separately from the other administrative services.)

Presently, I've moved the administrative ports back to their defaults but use a local-in policy (CLI only) to first exempt trusted IPs followed by another policy to block all access to the administrative ports.  Now, nobody except trusted IPs can attempt connections via HTTPS or SSH but PING still works from anywhere.

I wish local-in policies could be viewed from the GUI.  I don't care about editing as much as the ability for somebody else to have a clue what I've done.  I'm talking about 5.0.x here, FWIW.

Hello,

I personally used the following method.

First, I create an admin profile with NONE privilege.

Next, a create a user 'called it PING' with the NONE profile and NO IP restriction (to allow ping from everywhere).

Next, I limit the admin user to specific IP Range.

The external user can still try to connect but even if they discover the PING password, no privilege will be granted...

Regards,

HA