Howto unblock banned IP on SSL-VPN?

[nubi]

Hi, we have a FortiGate v6.4.2 build1723 (GA) where we use SSL-VPN.  Sometime the users enter (many times) the password wrong and the Forti block the public IP of the users and they have to wait for a long time to be automatically unblocked (unbanned). How Can I unblock that IP from the forti console to allow the user try the login again ?

[jintrah_FTNT]

Hi Nubi,

You can set an auth lockout duration as  minimum desired or even increase the number of attempts needed by a user to enter their passwords correctly.

#config user setting

#set auth-lockout?

auth-lockout-threshold -> Maximum number of failed login attempts before login lockout is triggered.
auth-lockout-duration  ->Lockout period in seconds after too many login failures.

#end

Best regards,

Jin

[pminarik · Accepted solution]

Unfortunately this is incorrect.

SSL-VPN lockout is controlled in "config vpn ssl settings":

login-attempt-limit - how many attempts are allowed <0~10; 0 = no limit, default=2>

login-block-time - how long to block an IP if the limit is reached <0~86400 seconds; default=60>

@nubi :

As for manually clearing the lockouts: As far as I am aware, there is no native mechanism to clear someone's block. You have to wait for it to expire.

If I had to guess, you might be able to reset it if you restart sslvpnd process, but that would also drop other SSL-VPN tunnels, so it would be unfeasible in production even if it worked.

There is an existing NFR asking for this feature, so if you're interested, let your Fortinet sales contact know that you'd like to see this in a future version.

[nubi]

Thank you so much!. I applied that solution and its workings as expected.

I did:
```

config vpn ssl settings

 set login-attempt-limit 3

 set login-block-time 180

end