Clarification Needed: User Field Marked as "N/A" in SSL VPN Logs

[lordaragon33]

Hello Fortinet Community,

    I am seeking some insights into an issue I've encountered with my Fortinet device logs related to SSL VPN events. In several log entries, I have noticed that the user field is consistently marked as "N/A". I'm trying to understand why this might be happening. Below is an example of one such log entry:

date=2023-11-10 time=07:06:18 devname=GED-RGF-G devid=KFLGZRJOD93LRJ34 eventtime=1699617977940457403 tz="-0500" logid="0101039944" type="event" subtype="vpn" level="error" vd="root" logdesc="SSL VPN alert" action="ssl-alert" tunneltype="ssl" tunnelid=0 remip=139.167.79.62 user="N/A" group="N/A" dst_host="N/A" reason="warning" desc="close notify" msg="SSL alerts"

Note that some details of the above log have been altered for privacy reasons.

Specifically, I would like to know:

1. What are the common reasons for the user field to be marked as "N/A" in such logs?
2. Is this indicative of a configuration issue or a potential security concern that I should be aware of?
3. Are there specific settings or conditions under which the user details are not logged or are unable to be captured?

Any guidance or recommendations for further troubleshooting this would be greatly appreciated. I'm particularly interested in ensuring that our logging is correctly configured and that we are able to accurately track and audit access attempts.

Thank you in advance for your assistance and insights.

[srajeswaran]

This is very common because, the SSL IP/Port is open towards internet and some random users/attackers might be trying to connect with your SSL device. They are not even reaching user auth phase, they just sent a SYN to open SSLVPN port 443 and Fortigate will send SYN-ACK (as expected because there is no Source IP restriction enabled for SSL VPN users). There is no more ACK and the SSL handshake itself will fail, it will generate the SSL-alert connection close messages. The user info is N/A because the user authentication never happened/attempted. if there was a user auth attempted, you will see message "msg="SSL user failed to logged in"".

in this particular case the connection is coming from 139.167.79.62 , if you are seeing a lot of message from this IP we can block these, but if they are random then we need to look for a DOS policy to match with the thresholds matching the genuine connections rate and these failed alerts/connections rate.

[srajeswaran]

Something you can try if your users are only from specific country/region https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-SSL-VPN-connectivity-from-cert...

[lordaragon33]

1. What are the possible reasons for these 'n/a' values appearing in the logs for certain users?
2. Are there any specific settings or configurations that we might need to adjust to rectify this issue?
3. Is there a best practice guide or any documentation that we can refer to for a better understanding of these log entries?
   
   
   
   

date=2023-11-10 time=04:44:28 devname=MKT-KLI-B" devid="GHYOLKGTF89DFT45" eventtime=1699609467581084036 tz="-0500" logid="0101039946" type="event" subtype="vpn" level="error" vd="root" logdesc="SSL VPN exit error" action="ssl-exit-error" tunneltype="ssl" tunnelid=0 remip=67.34.34.59 user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL exit error""

date=2023-11-10 time=07:13:27 devname=MKT-KLI-B" devid="GHYOLKGTF89DFT45" eventtime=1699618406774589116 tz="-0500" logid="0101039946" type="event" subtype="vpn" level="error" vd="root" logdesc="SSL VPN exit error" action="ssl-exit-error" tunneltype="ssl" tunnelid=0 remip=59.184.218.6 user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL exit error""

date=2023-11-10 time=04:44:57 devname=MKT-KLI-B" devid="GHYOLKGTF89DFT45" eventtime=1699609497015820744 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=67.34.34.59 user="N/A" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in""

date=2023-11-08 time=15:36:54 devname=MKT-KLI-B" devid="GHYOLKGTF89DFT45" eventtime=1699475814226648644 tz="-0500" logid="0101039943" type="event" subtype="vpn" level="information" vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=67.32.215.79 user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection""

[srajeswaran]

One thing common about all these logs are that they all belong to failed SSL VPN connection , so I believe the reason is there is no user information available. Do you see N/A on any logs for a successfull SSL-VPN connection?