SSLVPN failed user login attempts constantly been seen

[sam653]

Hello,

I am seeing constant alerts on my Fortigate under sslvpn events "sslvpn login failed"

This is not coming from the authorized users. Is there anything that can be done on it.

Thanks

[sprashant]

Hello @sam653 

You can refer to following resource:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-SSL-VPN-best-practices-guide/ta-...

This will walk you over the steps to strengthen the SSL VPN

[hjhajj]

Hello @sam653 

In  addition to the  above  given  document, Kindly also refer to the following document which explains how to secure and limit an SSL VPN unknown user login

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-secure-and-limit-an-SSL-VPN-unknown...

Thanks and Regards,
Harmandeep Kaur Jhajj

[Sgagan]

Greetings @sam653 

You can also configure an automation stitch in order to permanently block failed login attempts:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-permanently-block-SSL-VPN-failed-lo...