Login failed from 127.0.0.1

[shin_amuro]

Hi,

I am getting the following log every around 15 minutes on my 50E.

Administrator admin login failed from http(127.0.0.1) because of invalid password

Any has any idea on what is this could be?

Thanks

[Wayne11 · Accepted solution]

I bet you use FortiAnalyzer. Check the login credentials you have configured on both sides, on the FAZ and the FG.

[plz]

Wayne1 wrote:

I bet you use FortiAnalyzer. Check the login credentials you have configured on both sides, on the FAZ and the FG.

Wayne1, my login credentials FG201E is the same as FAZ200F. 

i also got this event log and my customer wondering what is this "Administrator admin login failed from http(127.0.0.1) because of invalid password" anyone can explain to me.

[Hosemacht]

Hey there,

i think he means : go to you Analyzer-> Device Management -> Edit your Device and edit Admin User and Password.

Regards

[emnoc]

Do you have a cluster?  The  FGT in a cluster uses  127.0.0.1 and telnet now that I think about it. Never seen http and the localhost in a admin auth messages.

Also add, make sure you  do not have a fortiexplorer hooked up to the  Fortigate, it also uses  127.0.0.1 and telnet. I bet this is your case and something is triggering because of this.

[plz]

emnoc wrote:

Do you have a cluster?  The  FGT in a cluster uses  127.0.0.1 and telnet now that I think about it. Never seen http and the localhost in a admin auth messages.

Also add, make sure you  do not have a fortiexplorer hooked up to the  Fortigate, it also uses  127.0.0.1 and telnet. I bet this is your case and something is triggering because of this.

Hi emnoc,

Thank you so much for your reply. i think that make sense and i i disable FortiTelemetry. waiting for result checked. 

[plz]

emnoc wrote:

Do you have a cluster?  The  FGT in a cluster uses  127.0.0.1 and telnet now that I think about it. Never seen http and the localhost in a admin auth messages.

Also add, make sure you  do not have a fortiexplorer hooked up to the  Fortigate, it also uses  127.0.0.1 and telnet. I bet this is your case and something is triggering because of this.

Yes i have cluster and i try to find how to disable fortiexplorer or some thing related this behavior i can not found.

do you have recommend to do this.

[plz]

the_giraffe_that_wasnt_president wrote:

Hey there,

i think he means : go to you Analyzer-> Device Management -> Edit your Device and edit Admin User and Password.

Regards

it is the same admin and password.

[plz]

the_giraffe_that_wasnt_president wrote:

Hey there,

i think he means : go to you Analyzer-> Device Management -> Edit your Device and edit Admin User and Password.

Regards

Ok this issue was solve. Thanks.

[Prab]

This can also happen if you are managing the FGT from a FortiManager. The above solution will fix this issue.