Someone trying to hack my firewall !!

[#1]

Hello, Everyday I got these error but I wonder if really anyone trying to hack my firewall , if it is real please help me to secure my fortigate 36 2010-12-15 07:50:09 alert admin 41985 200.201.180.130 login Login disabled from IP 200.201.180.130 for 60 seconds because of too many bad attempts 37 2010-12-15 07:50:09 alert admin 41985 ssh(200.201.180.130) login Administrator payala login failed from ssh(200.201.180.130) because of invalid user name 38 2010-12-15 07:50:06 alert admin 41985 ssh(200.201.180.130) login Administrator root login failed from ssh(200.201.180.130) because of invalid user name 39 2010-12-15 07:50:03 alert admin 41985 ssh(200.201.180.130) login Administrator eaguilar login failed from ssh(200.201.180.130) because of invalid user name 40 2010-12-14 20:28:57 alert admin 41985 210.66.168.73 login Login disabled from IP 210.66.168.73 for 60 seconds because of too many bad attempts 41 2010-12-14 20:28:57 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 42 2010-12-14 20:28:54 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 43 2010-12-14 20:28:51 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 44 2010-12-14 19:45:07 alert admin 41985 60.50.24.134 login Login disabled from IP 60.50.24.134 for 60 seconds because of too many bad attempts 45 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name 46 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name 47 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name

[#2]

you are the man , thank you so much ede_pfau :)

[ede_pfau]

you' re welcome! Glad you are getting forward.

[g3rman]

Also check out this post on locking down administrative services without changing port numbers: http://firewallguru.blogspot.com/2009/02/securing-firewall-administrator-access.html

[mario_veiga]

Besides changing admin ports from ssh 22 and https 443 try this if you have and available public ip.

Create a new interface on your firewall making it a loopback interface. Use a private ip /32 host. Example 172.16.1.1/32 or 192.168.1.1. Allow https and ssh access on this loop back interface. Now creat a VIP pointing to the loop back ip using a public ip. Example 123.234.245.267 nat to loopback ip you used. Now you can create a firewall policy allowing Outside/Wan to this VIP on https ssh or whatever ports you need. But now you can specify a source. You can even use a GEO ip to only allow inbound access to your firewall from a certain country. Create a deny policy below this to log attempted logins. Test access using new public ip before disabling https and ssh on your current outside wan interface.