Hello Fortinet Community,
I am seeking some insights into an issue I've encountered with my Fortinet device logs related to SSL VPN events. In several log entries, I have noticed that the user field is consistently marked as "N/A". I'm trying to understand why this might be happening. Below is an example of one such log entry:
date=2023-11-10 time=07:06:18 devname=GED-RGF-G devid=KFLGZRJOD93LRJ34 eventtime=1699617977940457403 tz="-0500" logid="0101039944" type="event" subtype="vpn" level="error" vd="root" logdesc="SSL VPN alert" action="ssl-alert" tunneltype="ssl" tunnelid=0 remip=139.167.79.62 user="N/A" group="N/A" dst_host="N/A" reason="warning" desc="close notify" msg="SSL alerts"
Note that some details of the above log have been altered for privacy reasons.
Specifically, I would like to know:
Any guidance or recommendations for further troubleshooting this would be greatly appreciated. I'm particularly interested in ensuring that our logging is correctly configured and that we are able to accurately track and audit access attempts.
Thank you in advance for your assistance and insights.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
This is very common because, the SSL IP/Port is open towards internet and some random users/attackers might be trying to connect with your SSL device. They are not even reaching user auth phase, they just sent a SYN to open SSLVPN port 443 and Fortigate will send SYN-ACK (as expected because there is no Source IP restriction enabled for SSL VPN users). There is no more ACK and the SSL handshake itself will fail, it will generate the SSL-alert connection close messages. The user info is N/A because the user authentication never happened/attempted. if there was a user auth attempted, you will see message "msg="SSL user failed to logged in"".
in this particular case the connection is coming from 139.167.79.62 , if you are seeing a lot of message from this IP we can block these, but if they are random then we need to look for a DOS policy to match with the thresholds matching the genuine connections rate and these failed alerts/connections rate.
Something you can try if your users are only from specific country/region https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-SSL-VPN-connectivity-from-cert...
date=2023-11-10 time=04:44:28 devname=MKT-KLI-B" devid="GHYOLKGTF89DFT45" eventtime=1699609467581084036 tz="-0500" logid="0101039946" type="event" subtype="vpn" level="error" vd="root" logdesc="SSL VPN exit error" action="ssl-exit-error" tunneltype="ssl" tunnelid=0 remip=67.34.34.59 user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL exit error""
date=2023-11-10 time=07:13:27 devname=MKT-KLI-B" devid="GHYOLKGTF89DFT45" eventtime=1699618406774589116 tz="-0500" logid="0101039946" type="event" subtype="vpn" level="error" vd="root" logdesc="SSL VPN exit error" action="ssl-exit-error" tunneltype="ssl" tunnelid=0 remip=59.184.218.6 user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL exit error""
date=2023-11-10 time=04:44:57 devname=MKT-KLI-B" devid="GHYOLKGTF89DFT45" eventtime=1699609497015820744 tz="-0500" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=67.34.34.59 user="N/A" group="N/A" dst_host="N/A" reason="sslvpn_login_unknown_user" msg="SSL user failed to logged in""
date=2023-11-08 time=15:36:54 devname=MKT-KLI-B" devid="GHYOLKGTF89DFT45" eventtime=1699475814226648644 tz="-0500" logid="0101039943" type="event" subtype="vpn" level="information" vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=67.32.215.79 user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection""
One thing common about all these logs are that they all belong to failed SSL VPN connection , so I believe the reason is there is no user information available. Do you see N/A on any logs for a successfull SSL-VPN connection?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1679 | |
1085 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.