Someone trying to hack my firewall !!

[#1]

Hello, Everyday I got these error but I wonder if really anyone trying to hack my firewall , if it is real please help me to secure my fortigate 36 2010-12-15 07:50:09 alert admin 41985 200.201.180.130 login Login disabled from IP 200.201.180.130 for 60 seconds because of too many bad attempts 37 2010-12-15 07:50:09 alert admin 41985 ssh(200.201.180.130) login Administrator payala login failed from ssh(200.201.180.130) because of invalid user name 38 2010-12-15 07:50:06 alert admin 41985 ssh(200.201.180.130) login Administrator root login failed from ssh(200.201.180.130) because of invalid user name 39 2010-12-15 07:50:03 alert admin 41985 ssh(200.201.180.130) login Administrator eaguilar login failed from ssh(200.201.180.130) because of invalid user name 40 2010-12-14 20:28:57 alert admin 41985 210.66.168.73 login Login disabled from IP 210.66.168.73 for 60 seconds because of too many bad attempts 41 2010-12-14 20:28:57 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 42 2010-12-14 20:28:54 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 43 2010-12-14 20:28:51 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 44 2010-12-14 19:45:07 alert admin 41985 60.50.24.134 login Login disabled from IP 60.50.24.134 for 60 seconds because of too many bad attempts 45 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name 46 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name 47 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name

[abelio]

Indeed, it could be just a script kiddie trying to remote access your unit. . Do you need really external SSH admin access? . Use trusted-hosts for administrative admin account . a lot of good practices about this are available regards,

[#3]

Two more things you need to do for each device: 1) Change super_admin name. Make it something non-standard for an admin account like: Phineas, Gandalf, or Toothless... well you get the idea. 2) Change the port numbers for your admin ports. Instead of 22 for ssh, use 22342 or something like that. Don' t forget to change the HTTPS port while you are at it. Hope that helps.

[abelio]

2) Change the port numbers for your admin ports. Instead of 22 for ssh, use 22342 or something like that.

well, it could be useful although but it could be security by oscurity, a very short term approach. It' s useful for scriptkiddies and mantaing more cleaner your events logs, but nothing that a one minute nmap scan couldn' t reveal... regards

[ede_pfau]

...but then again, most of the automated attacks just try the standard ports. Unfortunately, you cannot use IPS to protect the admin access to the FG itself (or can you??). After changing the admin port to the high end the number of login attempts has dropped on all FGs that I administer by 99%.

[emnoc]

After changing the admin port to the high end the number of login attempts has dropped on all FGs that I administer by 99%.

same here, I run 2022 for all external admin interfaces. Works like a charm and reduce or in my case, eliminates all ssh/login failures. I wish ciscoASA would allow for something like this

[#7]

Thanks all ,Sorry but what is meaning by SSH access ? and how can I disable it ? about the ports, which port I have to change ? Web Administration Ports HTTP: 80 HTTPS:443 SSLVPN Login : 10443 Telnet : 23 SSH :22 I understood that I have to change SSH port to something like 5124 than I login to the device by this https//:ip:5124 Am I right ?

[ede_pfau]

OK, first things first. You enable administrative access to the firewall in Network>Interface>interface_name for whatever interface you want to use to manage your firewall. I do not recommend to do this on wan/wan1 interface like you do now. I you want to manage the firewall from remote, create a dial-in VPN to the internal LAN, and enable admin access on ' internal' . You need HTTPS (for browser), SSH (for command line) and PING (for troubleshooting). HTTP and TELNET not recommended because the password is transmitted in cleartext. SNMP if you need it. Then, in System>Admin>Settings, change the default ports for HTTPS at least. SSH if used. For SSH command line you need a terminal client software, such as WinSSH. It does not work with a browser. SSH is an encrypted protocol for terminal access. HTTPS access would then be https://myFortigate:51443 i.e. if you don' t use the default port 443 then you have to specify it with the web address. Again, you CAN do that with the wan interface. I wouldn' t do it. But for the VPN method, you must be sure that VPN will work, or you won' t get in.

[#9]

thank ede_pfau so much for your helpful post, I' ll disable SSH in internal & WAN cause I didn' t use it , just configure the firewall using web browser. I changed the HTTPS port to 51443 but I still connect normally without specify the port number , I noticed that I connect using HTTP not HTTPS HTTP:\\fortigateip

[ede_pfau]

...then you have enabled it in the interface settings! Disable that asap.