Daily Report Failed Admin logins

[patrickwilson82]

Hello, I’m still somewhat new to the network admin world, so forgive me if this a dumb question. On the Daily report my Fortigate sends me, I see quite a few failed admin logins from external IP’s. Is this something to be concerned about? Is there anything I need to look at doing to fine tune my security? Thanks in advance for the help.

[Toshi_Esumi]

Depends. If all outside ports allowing admin access are supposed to be locked down by trusthosts, something is wrong with your admin config. The best practice for remote admin access from outside is to allow only VPN users and lock down anything facing to the internet. Then you shouldn't see those.

[patrickwilson82]

Got it. Thanks for the tip!