Failed admin authentication attempt

[Marian]

Hi, I have a Fortigate and in the Dashboard I see very often, in the Alert Message Console this kind of messages: Failed admin authentication attempt for ... So I gess that there is someone trying to access to the Fortigate management. So I am very worried. I would like to know where I can see if some of that attempts were successfull and if there is something that I could do in order to not let them get into the Fortigate. Thanks

[Carl_Wallmark]

Hi, The event log says if a logon attempt was successfull. You should disable any remote management on the interface facing the Internet. And if you must have them enabled, set a " trusted source ip" on the admin account.

[Marian]

Ok, Thanks for the quick response. best regards Marian

[davidinark]

I am seeing the same thing, but for ROOT and for AA. I disable admin from outside my network, but how do you disable root and aa? Who is aa?

[ede_pfau]

Usually that means that you have Admin access allowed on the WAN port (HTTP, HTTPS, telnet or ssh). The villains might try any name but ' root' is quite common. ' aa' stands for Anonymous Addict or Almighty Admin, they' ve just made it up. If you HAVE TO have admin access on the WAN port you can - rename the admin account - change the service port to >20.000 - restrict the IP (range) allowed to connect The latter option is often infeasable, the former ones standard.