Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ianmclachlan
New Contributor

SSL VPN

Hi Guys,

 

Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country.

 

Many thanks,

 

IM

 

 

2 Solutions
rg2017
New Contributor III

It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.

 

I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.

View solution in original post

nkasiou
New Contributor

Following up. 

 

We can see that the source IPs are Hacked devices from all over the world. 

if you add the IPs on the browser you can see that they are routers, hotspots, network devices  etc....

so they are redirecting their malicious requests through the hacked devices.

 

Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices. 

 

the bad thing is that the hacked devices are too many so you cannot just block the IPs. 

 

Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.

View solution in original post

21 REPLIES 21
rg2017
New Contributor III

Hello. You can create an address from Policy and Objects and specify a type of Geography. I'm seeing attempts in the past few days of someone trying to connect to VPN as "administrator" which isn't a valid user. They are coming from other countries. I've added geographical locations to a block policy, but the lists Fortinet provides don't appear to be complete as connections from the companies specified aren't blocked.

 

 

ianmclachlan

Strange, I'm getting the same attempts to login as "administrator" on two seperate sites on two different Fortinet's, hence my question.

 

I tried to set the source on "SSL-VPN Interface to LAN" to my country only.  But that blocked everyones access to systems/IP's on the LAN for some reason.

 

@rg2017 ...  where are you applying the geo policy?

 

ihaqueit

shehab
New Contributor III

Dear All,

 

We are facing the exact issue, a mixture of admin and administrator failed logins on the sslvpn.

 

Starting from 2021-08-18 , single trial and its keep on going in a shuffled timeframe ( or every 90 min).

 

BR,

Shehab

ronanlg
New Contributor

Dear Forti users,

 

Same for me since 18th this month. 7 fortigates on independents sites in France, and same issues. Login attempts from different countries (BR, VN, KR, TH ...)- for users : "user",  "admin" and "administrator". I'm using 10443 port for SSL VPN, what is our port ? It's really strange...

 

I've applied a restriction to allow connections only from French IP.

 

Ronan.

 

rg2017
New Contributor III

It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.

 

I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.

ianmclachlan

Exactly the same thing - (last couple of days, different IP's, mixture of admin and administrator ... and infrequent)  I assumed it was a BF, but so low not to trigger any account lockout or IDS.  Just common admin passwords ...

 

Good call on placing a policy at top of WAN > LAN blocking all traffic from a geo.  I'll give that a go.

Ger
New Contributor II

Hi, I'm having the same issue, mostly from india and malaysia. At first I tried to add the source ip as an address and the add those IP's to an address group, but I think this is not the best solution, I just create an user in this site to see if I can find information about this.

 

I don't know if add an address range to exlcude those IP's will work.. looking for more information about this.

 

I read that you can add those ip to quarantine, but after a reboot of the unit this will get lost.

 

 

tomasbond
New Contributor

My fortigate VPN SSL is being brute force too. Is it possible to set up and IPS profile to block this from happening? Im having a random user login from two random IPs every 5 minutes. Most IPs come from china, but not all. Its a botnet knocking on my front door. What can i do to protect myself?

 

PD: reading some other posts, where just administrator and admin are the users being used. in my case administrator was used but not the only. mosly common username like "sales, marketing, john, etc".

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors