Technical Tip: Configure an automation stitch to get an email alert for SSL VPN login failures

[Mrinmoy]

Description	This article describes how to configure an automation stitch to provide email alerts when SSL VPN login failures appear in the logs.
Scope	FortiOS 6.4 or above.
Solution	Create an Automation stitch under Security Fabric -> Automation -> Stitch -> Create New. Give it the name and trigger shown in the screenshot below: Configure the action in the screenshot below: Next, test the stitch by entering the wrong user ID or password. Check the status from the firewall and check for an email. The CLI part after configuration is as follows: Stitch: config system automation-stitch edit "SSL VPN Login-Failure" set trigger "SSL-VPN-Login" config actions edit 1 set action "SSL-VPN-Failed" set required enable next end next end Trigger: config system automation-trigger edit "SSL-VPN-Login" set event-type event-log set logid 39426 next end Action: config system automation-action edit "SSL-VPN-Login-Failed" set action-type email set email-to "abc@xyz.com" set email-subject "SSL-VPN-Login-Failed" next end Log: The email will contain the following log: date=2023-11-24 time=09:39:36 devid="FGT61FTK22059174" devname="FGT" eventtime=1700847576403329440 tz="-0800" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="SSL-VPN-Failed" tunneltype="ssl-web" tunnelid=0 remip=209.87.240.230 srccountry="Canada" user="user01" group="N/A" dst_host="N/A" reason="sslvpn_login_permission_denied" msg="SSL user failed to logged in" Note: If the automation stitch is triggered but fails to receive an email alert, refer to Troubleshooting Tip: Email alert or contact Fortinet Support for assistance. Related articles: Technical Tip: How to receive an alert email when SSL VPN user login successfully Technical Tip: How to limit SSL VPN login attempts and block duration Technical Tip: How to permanently block SSL VPN failed logins using an Automation Stitch