Login failed from 127.0.0.1

[shin_amuro]

Hi,

I am getting the following logs every around 15 minutes on my 50E

Administrator admin login failed from http(127.0.0.1) because of invalid password

Any has any idea on what is this could be?

Thanks

[SteveG]

I'm seeing that too, also had some post upgrade issues that seem related to firefox. Using Chrome 'fixes' the problem. Try clearing your firefox cache as that helped for me re the incorrect HA Status Dashboard feed back I was getting.

[SteveG]

We are seeing this on 5.6.3, tonight we upgraded two other 200Ds to 5.6.3 and starting seeing the same thing on these when using firefox.

[SteveG]

I just refreshed the 5.6.3 fortigate and immediately received this warning.

ui="http(127.0.0.1)" method="http" srcip=127.0.0.1 dstip=127.0.0.1 action="login" status="failed" reason="passwd_invalid"

[emnoc]

I would run a diag sniffer any "host 127.0.0.1" and see what's happening, it could be something that's configured or maybe HA  ( HA typical uses a 169.254 APIPA  addressing )

Ken

[SteveG]

I have a sneaky suspicion it's being caused by having the "HA Status" Widget in the dashboard. We have four 200D's at different sites running 5.6.3 and the only two I'm getting these errors from have that dashboard enabled. I've removed the HA Widget from one of the 200D's so I'll report back if that stops the auth errors.

[emnoc]

If you have multiple   vdom I would scroll thru them all and use the cli-cmd

cli;

get sys session list | grep 127.0

get system  source-ip status

 diag  ip tcp list

 diag  ip udp list

[FatalHalt]

What firmware are you on?

[Prab]

shin_amuro wrote:

Hi,

I am getting the following logs every around 15 minutes on my 50E

Administrator admin login failed from http(127.0.0.1) because of invalid password

Any has any idea on what is this could be?

Thanks

I had the same issue, we use fortiManager-FMG to manage the FGT cluster. It seems that you might need to once update the credentials on the FMG.

After that the issue got resolved, now in logs we see authentication successful instead of failed.

Best regards,

Prab