Brute force attacker username admin

[Duy2003]

Hi team,
I have configured to disable access http and https on the interfaces, configured trust host on the admin account but still reported brute force log

[funkylicious]

Hi,

Are you seeing them in logs for VPN or System Events ?

[Duy2003]

Hi @funkylicious ,
I am seeing them in logs for System Events

[funkylicious]

Well, if you disabled http/https for the wan interfaces, maybe they are ssh attempts?

I would advise you to use trusted hosts for all your administrators.

If one user/admin doesn't have trusted hosts enabled/configured , the mgmt ( ssh/http/https ) will still be opened from everywhere and attempts/brute force can be made ( the good part is that even they know the pass for the user that has it configured but the src ip isnt the one in the trustedhosts it cannot be accessed/permitted ), but if for all are configured nothing ( no prompt to enter credentials ) will be made available for them.

Another option would be to use local-in policies, cli configurable only.

[Duy2003]

Hi @funkylicious 
This is logs content for log system

[funkylicious]

Hi,

Are you using FortiAnalyzer by any chance ?

L.E. if so, please have a look at https://community.fortinet.com/t5/FortiAnalyzer/Technical-tip-Admin-login-from-127-0-0-1/ta-p/191892

[Duy2003]

Yes, I use FortiAnalyzer

[funkylicious]

Check the link from above.

[mpandya]

Configure local in policy 

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/363127/local-in-policy

And configure isdb for malicious traffic action drop based 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Potential-threats-over-Internet-s...