BruteForce Blocking/Filtering

[c0re1337]

Hello Fortinet Community. I hope you have ideas on how we can solve our problem. At the moment we have massive problems with BruteFrce attacks on our Fortigate 100F - V 7.2.9 - Our users connect to our company network via FortiClient VPN. The bruteforce attack uses frequently used names in our country, such as Smith, Meyer etc. and exactly these users are blocked daily. Now the question is whether a Mac address filter or the OS check can be used here or whether the whole thing is useless, as the credentials may be queried in AD beforehand and only then is the OS, Mac address etc. checked. We were unable to find this out from the documentation. Thanks in advance, Alex.

[AEH]

Dear,

Please check this this technical tips in order to prevent bruteforce attacks on your fortigate :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Automation-script-to-BAN-Brute-Force-attac... 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-prevent-brute-force-attempts-to-a-F...

I hope it helps you.

Best regards.

[conikco2]

If you upgrade to the latest firmware you can turn off the virtual office web interface. This will give them nothing to login to. Make you WAN mgmt is turned off. These will help you, but stop them trying to connect to you. I would suggest that instead of blocking the bad IP addresses, you write a rule that drops the packets. Blocking sends them a deny message, drop turns you into a black hole and gives less info. I would go into the Network - Firewall and think Advanced menu and turn on Stealth mode and randomize IP options to minimize your footprint.