SSL VPN

[ianmclachlan]

Hi Guys,

Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country.

Many thanks,

IM

[rg2017 · Accepted solution]

It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.

I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.

[rg2017]

Hello. You can create an address from Policy and Objects and specify a type of Geography. I'm seeing attempts in the past few days of someone trying to connect to VPN as "administrator" which isn't a valid user. They are coming from other countries. I've added geographical locations to a block policy, but the lists Fortinet provides don't appear to be complete as connections from the companies specified aren't blocked.

[ianmclachlan]

Strange, I'm getting the same attempts to login as "administrator" on two seperate sites on two different Fortinet's, hence my question.

I tried to set the source on "SSL-VPN Interface to LAN" to my country only.  But that blocked everyones access to systems/IP's on the LAN for some reason.

@rg2017 ...  where are you applying the geo policy?

[ihaqueit]

Please check this.

Using the Geo IP block list (fortinet.com)

[shehab]

Dear All,

We are facing the exact issue, a mixture of admin and administrator failed logins on the sslvpn.

Starting from 2021-08-18 , single trial and its keep on going in a shuffled timeframe ( or every 90 min).

BR,

Shehab

[ronanlg]

Dear Forti users,

Same for me since 18th this month. 7 fortigates on independents sites in France, and same issues. Login attempts from different countries (BR, VN, KR, TH ...)- for users : "user",  "admin" and "administrator". I'm using 10443 port for SSL VPN, what is our port ? It's really strange...

I've applied a restriction to allow connections only from French IP.

Ronan.

[rg2017 · Accepted solution]

It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.

I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.

[ianmclachlan]

Exactly the same thing - (last couple of days, different IP's, mixture of admin and administrator ... and infrequent)  I assumed it was a BF, but so low not to trigger any account lockout or IDS.  Just common admin passwords ...

Good call on placing a policy at top of WAN > LAN blocking all traffic from a geo.  I'll give that a go.

[Ger]

Hi, I'm having the same issue, mostly from india and malaysia. At first I tried to add the source ip as an address and the add those IP's to an address group, but I think this is not the best solution, I just create an user in this site to see if I can find information about this.

I don't know if add an address range to exlcude those IP's will work.. looking for more information about this.

I read that you can add those ip to quarantine, but after a reboot of the unit this will get lost.

[tomasbond]

My fortigate VPN SSL is being brute force too. Is it possible to set up and IPS profile to block this from happening? Im having a random user login from two random IPs every 5 minutes. Most IPs come from china, but not all. Its a botnet knocking on my front door. What can i do to protect myself?

PD: reading some other posts, where just administrator and admin are the users being used. in my case administrator was used but not the only. mosly common username like "sales, marketing, john, etc".