Issue logging into firewall FG 60C

[champ2152]

Hello,

We have been getting messages on the firewall that remote user has been trying to get access. The message was "Failed admin authentication attempt for root". I did some searching and found out a way to trust certain IP's in the admin section.

So I decided to add my public IP for this trusted admin log in's. No sure if this was right way in hind sight.

Anyway now I am not able to access the web interface internally. Not sure if the local IP had to be added.

I downloaded Fortiexplorer and connected it via USB cable. I am able to connect to the firewall but the log in still does not work connected via cable.

Is their any other way around this besides resetting the entire firewall settings?

Any help is greatly appreciated. 

[Toshi_Esumi]

By default FGT accepts any remote admin accesses on the interfaces that are configured to accept those accesses. Once you configured a "trusthost" in administrator config (not 0.0.0.0/0) it starts limitting access only to those hosts (otherwise trusthosts don't mean anything). If you want to allow access from inside as well, you need to specify the LAN subnet to trusthost2 or other.

[champ2152]

toshiesumi wrote:

By default FGT accepts any remote admin accesses on the interfaces that are configured to accept those accesses. Once you configured a "trusthost" in administrator config (not 0.0.0.0/0) it starts limitting access only to those hosts (otherwise trusthosts don't mean anything). If you want to allow access from inside as well, you need to specify the LAN subnet to trusthost2 or other.

So i would need to put my public ip in the first trusthost and then my local ip in the trusthost 2? If i put the public ip in the first trusted host shouldnt any computer with that public IP be able to access it?

[Toshi_Esumi]

The trusthosts are trusted host IPs that FGT see as in the source IP. When you're accessing from outside, the FGT would see your public IP. When you're connected from inside, it sees your internal IP. If you don't need access from outisde interface, I would recommend not to allow access on the outside interface at all but allow it only on the internal interface.

[champ2152]

toshiesumi wrote:

The trusthosts are trusted host IPs that FGT see as in the source IP. When you're accessing from outside, the FGT would see your public IP. When you're connected from inside, it sees your internal IP. If you don't need access from outisde interface, I would recommend not to allow access on the outside interface at all but allow it only on the internal interface.

How would you allow on the internal interface only? Just use the local ip in the trusted hosts?

Also do you know anyway to get back into the interface. Because now after i changed the trusted ip to my public IP i can not access the portal.

[Toshi_Esumi]

On each interface, there are check boxes in GUI, or "set allowaccess" command to allow admin access and other protocols like https, ssh, and so on. Just uncheck those on the outside interface and allow them on the inside interface and use inside interface IP to access it from inside.

[champ2152]

toshiesumi wrote:

On each interface, there are check boxes in GUI, or "set allowaccess" command to allow admin access and other protocols like https, ssh, and so on. Just uncheck those on the outside interface and allow them on the inside interface and use inside interface IP to access it from inside.

Ok I will do that then. Any idea if their is a way to get back on my device without resetting the firewall?

[Toshi_Esumi]

To just regain the access via the interfaces, either adding your source IP or remove all trusthosts you configured (sounds like only one) would do it. I don't see any reason you have to reboot (wouldn't solve it anyway) or factory-reset it.

[champ2152]

Right but i can not access the interface is the problem. When i try to access the interface from the USB directly connecting the logins do not work. My guess is because I put the public IP in the admin access.

So currently i am not able to log into the firewall portal. That is my current issue. 

[Toshi_Esumi]

Use the console (serial) port. That's the last resort.