Description
This article describes how to leverage FortiAnalyzer event handlers and FortiGate automation capabilities to block remote IP addresses that are probing the SSL VPN via authentication attempts.
Scope
FortiGate v7.0.X, v7.2.X, v7.4.X and FortiAnalyzer v7.4.X.
Solution
Topology:
Prerequisites:
- FortiAnalyzer logging must be enabled in FortiGate,
- Connectivity between FortiGate and FortiAnalyzer should be up as shown below.
- The options 'Allow access to Fortigate Rest API' and 'Verify Fortianalyzer Certificate' must be enabled as shown again below. FortiAnalyzer will only send an event notification using a REST API inside the OFTP tunnel to the FortiGate that generated the log.
Configure an Event Handler in FortiAnalyzer to detect multiple failed SSL VPN attempts from an IP address:
- Navigate to Incident & Events -> Handlers -> Basic Handlers and select 'Create New'.
- Configure an Event Handler as shown below:
In this example, the event handler activates upon detection of a VPN event log, indicating the 'ssl-login-fail' action, with events grouped by Remote IP (i.e., the initiating IP address for SSL VPN connections). It specifically triggers when there are two SSL VPN failed login attempts from an IP address within a one-minute timeframe. Make sure to enable the option 'Automation Stitch'.
Configuring an Automation Stitch on FortiGate:
- Create a New Automation Trigger for the FortiAnalyzer Event Handler:
- Configure a FortiAnalyzer Event Handler Trigger as shown below (FortiGate will display the Event Handlers configured in FortiAnalyzer):
- Configure a CLI Script. Navigate to Security Fabric -> Automation -> Action, then select 'Create New' -> CLI Script:
Configure an Automation Stitch with the previously created components:
- Navigate under Security Fabric -> Automation -> Stitch and select 'Create New'.
Create a Local-In Policy to block SSL VPN attempts as shown below:
If there are any local-in policies already configured, make sure to move this policy to the top of the list using the command 'move <policy_id> before <policy_id>' (example: move 2 before 1).
