Skip to main content
Fortiben1
Explorer II
December 11, 2024
Question

Unknown user logs in endpoint logs

  • December 11, 2024
  • 1 reply
  • 754 views

Good day Folks!

 

I just wanna ask what is the reason behind this extra logs when remote users is connecting using forticlient (IPSEC-VPN). As per checking the the forticlient ID (that is unique and cant be duplicated) and other info are the same with the user. see attached image (Fortigate 7.2.10)

 

5656.png

1 reply

Hatibi
Staff & Editor
Staff & Editor
December 12, 2024

Apparently this is intended in 7.2.X

 

Explained in this article: https://community.fortinet.com/t5/FortiGate/Troubleshooting-TIp-Dial-up-IPsec-shows-Unknown-User-under/ta-p/339137

 

UNKNOWN user provide extra information about the overlay tunnel setting itself. This is intended behavior and included by design.