Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
CrysbergIT
New Contributor

How to stop Fortigate FG100ETK from sending notifications on invalid VPN login attempts

Hi Fortigate'rs

 

I have a (two actually in a HA config) FG101ETK Firewalls which I am very happy with.

 

However, it constantly sends me e-mails when people are trying to "hack" our VPN. I'd like to avoid getting those errors as they clutter my inbox and may hide important messages, and there's really nothing I can about it anyway.

 

Message meets Alert condition

date=2023-06-19 time=04:58:21 devname=FG101ETK00000000 devid=FG101ETK00000000 eventtime=1687143501487137862 tz="+0200" logid="0106037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action="negotiate" remip=61.66.190.98 locip=1.2.3.4 remport=8512 locport=500 outintf="wan" cookies="3e35cd0719dfedef/0000000000000000" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="failure" init="remote" mode="main" dir="inbound" stage=1 role="responder" result="ERROR"

 

How do I stop the firewall from sending those messages (only these, VPN-related ones!)

 

I'm on 7.0.9 build0444 by the way.

 

Best, 

 

Bjorn

1 Solution
Yurisk
Valued Contributor

Then left is the 'old' way of configuring it - check on CLI show alertmail setting

Or in GUI (but I think in 7.0.x this option was removed from the GUI) https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-alert-email-settings/ta-p... 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.

View solution in original post

Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
6 REPLIES 6
Yurisk
Valued Contributor

Hi, as this is 7.0.9 good chance you have Automation Stitch that fires each time and sends this email alert. Look in  Security Fabric -> Automation and look at the column "Trigger Count" for recently triggered stitches - one of them will be yours, you can then disable it.

 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
CrysbergIT

Yeah, I actually looked there, but I can only find 2 triggers that has any value above 0 in "Trigger count" - HA Failover (which is not the one) and "Security Rating Notification" which also doesnt seem to have anything to do with it.

Yurisk
Valued Contributor

Then left is the 'old' way of configuring it - check on CLI show alertmail setting

Or in GUI (but I think in 7.0.x this option was removed from the GUI) https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-alert-email-settings/ta-p... 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
CrysbergIT

You are right @Yurisk . The "old" way (I'm new to FG so I wasn't aware of an "old" way) worked.

 

Apparently, FG has removed the old settings from the GUI so that you cannot see them anymore, even though they are still in effect. Not the best design...

 

I configured the firewall with these two commands:

 

config alertemail setting

set sslvpn-authentication-errors-logs disable

 That fixed it.

 

Thanks!

abelio
Valued Contributor

Hello
it's strange that it worked in your case.
ssl-authentication-errors-logs disable  
is related to SSL VPN failed logs.

Your original post talked about phase I errors in a IPSec VPN
try with

set IPsec-errors-logs disable

command (within the same 'config alertemail setting')

regards




/ Abel

regards / Abel
CrysbergIT

@abelio you are right. Actually, I had multiple authentication errors, "including but not limited to", Phase I errors. I also have a ton of SSL VPN Login errors like this one:

 

Message meets Alert condition

The following critical firewall event was detected: SSL VPN login fail.

date=2023-06-20 time=14:34:31 devname=FG101ETK00000000 devid=FG101ETK00000000 eventtime=1687264471367851041 tz="+0200" logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=107.14.14.45 user="admin" group="N/A" dst_host="N/A" reason="sslvpn_login_permission_denied" msg="SSL user failed to logged in" 

 

I just posted one of the commands, in this case the ssl-authentication-errors-logs disable .

 

Br, Bjorn

Top Kudoed Authors