Login failed from 127.0.0.1

[shin_amuro]

Hi,

I am getting the following log every around 15 minutes on my 50E.

Administrator admin login failed from http(127.0.0.1) because of invalid password

Any has any idea on what is this could be?

Thanks

[boneyard]

Got the same error now, using FortiManager but first asking support about it.

from what i remember from the past is that FortiManager doesn't need the admin account except when first setting up the connection. afterwards a SSL/TLS tunnel with certificate authentication is used, or did this change?

[plz]

Update!!! after i disable fortitelemetry this alert still apear. I am getting the following log every around 30 minutes.

[obasyouni]

https://kb.fortinet.com/kb/documentLink.do?externalID=FD47698 Description This article explains why under some circumstances, FortiGate can show successful (or failed) logins from 127.0.0.1 when logging to a FortiAnalyzer. Solution When FortiGates are configured to log to FortiAnalyzer, under some circumstances there can be logs regarding admin logins (or failed attempts) from 127.0.0.1. FortiAnalyzer not only shows information based on FortiGate logs, but can retrieve additional information from the FortiGate directly. This is done by FortiAnalyzer triggering a login from the miglogd daemon running on FortiGate and then querying the FortiGate API. Due to FortiAnalyzer communicating with the miglogd daemon in FortiGate and triggering the login from there, FortiGate can report an admin login from 127.0.0.1 (as the login comes from a local daemon). If FortiAnalyzer does not have correct credentials for FortiGate, then the login can fail and a log message regarding a failed login from 127.0.0.1 will be generated. Note: Login credentials to be used by FortiAnalyzer can be set from the GUI under Device Manager , select 'FortiGate' and then ‘Edit’.