Hi Guys,
Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries? Multiple IP's from several countries are trying to bruteforce the VPN. We don't have any VPN users needing access from outside the country.
Many thanks,
IM
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.
I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.
Following up.
We can see that the source IPs are Hacked devices from all over the world.
if you add the IPs on the browser you can see that they are routers, hotspots, network devices etc....
so they are redirecting their malicious requests through the hacked devices.
Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices.
the bad thing is that the hacked devices are too many so you cannot just block the IPs.
Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.
Hello. You can create an address from Policy and Objects and specify a type of Geography. I'm seeing attempts in the past few days of someone trying to connect to VPN as "administrator" which isn't a valid user. They are coming from other countries. I've added geographical locations to a block policy, but the lists Fortinet provides don't appear to be complete as connections from the companies specified aren't blocked.
Strange, I'm getting the same attempts to login as "administrator" on two seperate sites on two different Fortinet's, hence my question.
I tried to set the source on "SSL-VPN Interface to LAN" to my country only. But that blocked everyones access to systems/IP's on the LAN for some reason.
@rg2017 ... where are you applying the geo policy?
Dear All,
We are facing the exact issue, a mixture of admin and administrator failed logins on the sslvpn.
Starting from 2021-08-18 , single trial and its keep on going in a shuffled timeframe ( or every 90 min).
BR,
Shehab
Dear Forti users,
Same for me since 18th this month. 7 fortigates on independents sites in France, and same issues. Login attempts from different countries (BR, VN, KR, TH ...)- for users : "user", "admin" and "administrator". I'm using 10443 port for SSL VPN, what is our port ? It's really strange...
I've applied a restriction to allow connections only from French IP.
Ronan.
It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.
I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.
Exactly the same thing - (last couple of days, different IP's, mixture of admin and administrator ... and infrequent) I assumed it was a BF, but so low not to trigger any account lockout or IDS. Just common admin passwords ...
Good call on placing a policy at top of WAN > LAN blocking all traffic from a geo. I'll give that a go.
Hi, I'm having the same issue, mostly from india and malaysia. At first I tried to add the source ip as an address and the add those IP's to an address group, but I think this is not the best solution, I just create an user in this site to see if I can find information about this.
I don't know if add an address range to exlcude those IP's will work.. looking for more information about this.
I read that you can add those ip to quarantine, but after a reboot of the unit this will get lost.
My fortigate VPN SSL is being brute force too. Is it possible to set up and IPS profile to block this from happening? Im having a random user login from two random IPs every 5 minutes. Most IPs come from china, but not all. Its a botnet knocking on my front door. What can i do to protect myself?
PD: reading some other posts, where just administrator and admin are the users being used. in my case administrator was used but not the only. mosly common username like "sales, marketing, john, etc".
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.