How to stop Fortigate FG100ETK from sending notifications on invalid VPN login attempts

[CrysbergIT]

Hi Fortigate'rs

I have a (two actually in a HA config) FG101ETK Firewalls which I am very happy with.

However, it constantly sends me e-mails when people are trying to "hack" our VPN. I'd like to avoid getting those errors as they clutter my inbox and may hide important messages, and there's really nothing I can about it anyway.

Message meets Alert condition

date=2023-06-19 time=04:58:21 devname=FG101ETK00000000 devid=FG101ETK00000000 eventtime=1687143501487137862 tz="+0200" logid="0106037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action="negotiate" remip=61.66.190.98 locip=1.2.3.4 remport=8512 locport=500 outintf="wan" cookies="3e35cd0719dfedef/0000000000000000" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="failure" init="remote" mode="main" dir="inbound" stage=1 role="responder" result="ERROR"

How do I stop the firewall from sending those messages (only these, VPN-related ones!)

I'm on 7.0.9 build0444 by the way.

Best, 

Bjorn

[Yurisk]

Hi, as this is 7.0.9 good chance you have Automation Stitch that fires each time and sends this email alert. Look in  Security Fabric -> Automation and look at the column "Trigger Count" for recently triggered stitches - one of them will be yours, you can then disable it.

[CrysbergIT]

Yeah, I actually looked there, but I can only find 2 triggers that has any value above 0 in "Trigger count" - HA Failover (which is not the one) and "Security Rating Notification" which also doesnt seem to have anything to do with it.

[Yurisk · Accepted solution]

Then left is the 'old' way of configuring it - check on CLI show alertmail setting

Or in GUI (but I think in 7.0.x this option was removed from the GUI) https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-alert-email-settings/ta-p... 

[CrysbergIT]

You are right @Yurisk . The "old" way (I'm new to FG so I wasn't aware of an "old" way) worked.

Apparently, FG has removed the old settings from the GUI so that you cannot see them anymore, even though they are still in effect. Not the best design...

I configured the firewall with these two commands:

config alertemail setting

set sslvpn-authentication-errors-logs disable

 That fixed it.

Thanks!

[abelio]

Hello
it's strange that it worked in your case.
ssl-authentication-errors-logs disable  
is related to SSL VPN failed logs.

Your original post talked about phase I errors in a IPSec VPN
try with

set IPsec-errors-logs disable

command (within the same 'config alertemail setting')

[CrysbergIT]

@abelio you are right. Actually, I had multiple authentication errors, "including but not limited to", Phase I errors. I also have a ton of SSL VPN Login errors like this one:

Message meets Alert condition

The following critical firewall event was detected: SSL VPN login fail.

date=2023-06-20 time=14:34:31 devname=FG101ETK00000000 devid=FG101ETK00000000 eventtime=1687264471367851041 tz="+0200" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=107.14.14.45 user="admin" group="N/A" dst_host="N/A" reason="sslvpn_login_permission_denied" msg="SSL user failed to logged in" 

I just posted one of the commands, in this case the ssl-authentication-errors-logs disable .

Br, Bjorn