VPN SSL Portal Log

1 reply
1734 views

Hello everyone,

In the topic of the new vulnerability CVE 2023 27997 affecting FortiOS VPN SSL, I'm very interresting to monitor access to the vpn ssl web portal. Can exist a configuration on the FortiOS running the sslvpnd daemon to log web access request to the vpn ssl web portal ? For example, I need equivalent to webserver log with source address / method / uri / scheme / response code etc ...

With this topic, I will happy to help the community to fine tunning the log configuration to monitor current and, possible future vulnerability on the vpn ssl web portal.

Regards

FortiGate

knagaraju

Staff

Hi Nawhack,
You can view the source information of the user in Logs&Reports>>Events>>VPN events. However not all the mentioned things but it might give you some idea.

Please go through the below link for reference
https://community.fortinet.com/t5/FortiGate/Technical-Tip-View-historic-SSL-VPN-user-connectivity-logs/ta-p/192081

Regards
Nagaraju.