Hi Fortigate'rs
I have a (two actually in a HA config) FG101ETK Firewalls which I am very happy with.
However, it constantly sends me e-mails when people are trying to "hack" our VPN. I'd like to avoid getting those errors as they clutter my inbox and may hide important messages, and there's really nothing I can about it anyway.
Message meets Alert condition
date=2023-06-19 time=04:58:21 devname=FG101ETK00000000 devid=FG101ETK00000000 eventtime=1687143501487137862 tz="+0200" logid="0106037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action="negotiate" remip=61.66.190.98 locip=1.2.3.4 remport=8512 locport=500 outintf="wan" cookies="3e35cd0719dfedef/0000000000000000" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="failure" init="remote" mode="main" dir="inbound" stage=1 role="responder" result="ERROR"
How do I stop the firewall from sending those messages (only these, VPN-related ones!)
I'm on 7.0.9 build0444 by the way.
Best,
Bjorn
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Then left is the 'old' way of configuring it - check on CLI show alertmail setting
Or in GUI (but I think in 7.0.x this option was removed from the GUI) https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-alert-email-settings/ta-p...
Hi, as this is 7.0.9 good chance you have Automation Stitch that fires each time and sends this email alert. Look in Security Fabric -> Automation and look at the column "Trigger Count" for recently triggered stitches - one of them will be yours, you can then disable it.
Yeah, I actually looked there, but I can only find 2 triggers that has any value above 0 in "Trigger count" - HA Failover (which is not the one) and "Security Rating Notification" which also doesnt seem to have anything to do with it.
Then left is the 'old' way of configuring it - check on CLI show alertmail setting
Or in GUI (but I think in 7.0.x this option was removed from the GUI) https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-alert-email-settings/ta-p...
You are right @Yurisk . The "old" way (I'm new to FG so I wasn't aware of an "old" way) worked.
Apparently, FG has removed the old settings from the GUI so that you cannot see them anymore, even though they are still in effect. Not the best design...
I configured the firewall with these two commands:
config alertemail setting
set sslvpn-authentication-errors-logs disable
That fixed it.
Thanks!
Created on 06-20-2023 01:31 PM Edited on 06-20-2023 01:32 PM
Hello
it's strange that it worked in your case.
ssl-authentication-errors-logs disable
is related to SSL VPN failed logs.
Your original post talked about phase I errors in a IPSec VPN
try with
set IPsec-errors-logs disable
command (within the same 'config alertemail setting')
regards
/ Abel
@abelio you are right. Actually, I had multiple authentication errors, "including but not limited to", Phase I errors. I also have a ton of SSL VPN Login errors like this one:
Message meets Alert condition
The following critical firewall event was detected: SSL VPN login fail.
date=2023-06-20 time=14:34:31 devname=FG101ETK00000000 devid=FG101ETK00000000 eventtime=1687264471367851041 tz="+0200" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=107.14.14.45 user="admin" group="N/A" dst_host="N/A" reason="sslvpn_login_permission_denied" msg="SSL user failed to logged in"
I just posted one of the commands, in this case the ssl-authentication-errors-logs disable .
Br, Bjorn
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.