So this is a login to system admin, just define your fail login attempts and set an extreme long lockout.
Also if this is a common username like "admin" or "administrator" do NOT use these. You can delete "admin" account from the fortios cfg by creating a new admin with super-user then logging in with new user and rename "admin" and delete "admin"
And lastly , do not use port 22 for ssh and a untrust service.
here's what we do;
config sys global
set admin-login-max 100 set admin-lockout-duration 2147483647 set admin-lockout-threshold 10 set admin-scp enable set admin-server-cert "vpn1" set admin-ssh-port 2022end Other actions you can do; Ensure you have trust host sets and use MFA for logins.
Seems since this last response/question was asked in 2021 and has no replies, the answer would be "Nope"?
I've been getting an ip from the China ISP hitting my firewall with a constantly running script thats been trying to do an SSH login for a few weeks now. Its trying to login with a non-existent admin login, but still want to block the login attempt from happening.
There really is no way (short of changing ssh port#) to prevent the firewall from even bringing up a login prompt to blacklisted IPs or blocks of IPs? We have Admin accounts restricted to trusted hosts only, but looking to harden further and stop our firewall from being hammered by these constant login attempts
I'm researching setting up the local-in-policy It seems this can be set up (via CLI only?) to do what I am looking for?
You can configure an "anomaly detection" sensor and apply it to the security policy that allows SSH traffic. Within the anomaly sensor, you can define the parameters to consider an SSH brute force attack and take actions like blocking the IP. FortiGate's Intrusion Prevention System (IPS) includes predefined signatures to detect SSH brute-force attacks. Apply the IPS sensor to the security policy controlling your SSH access. Manually add offending IP addresses to an address object and set it to be "blocked" in the appropriate policy. This approach is not dynamic but can be useful for known malicious IP addresses. You can also set up a DoS policy to limit the number of SSH connections per second from an IP address.
For Anamoly Detection, Configure the sensor to detect SSH brute force attempts. You may set the threshold for the number of attempts and the action to take when the threshold is exceeded. Apply this sensor to the security policy that controls SSH access. For IPS sensor, Under IPS Sensors, edit the sensor applied to your SSH policy or create a new one. Enable the signatures related to SSH brute-force attacks. Apply the IPS sensor to the security policy that allows SSH access. Create a new DoS policy where the service is set to SSH. Set the Action to Rate Limit and define the maximum allowable rate.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.