Very strange behaivor Fortigate tries to Login per SSH

[Holy]

Hello,

i am Using a FortigateVM and a Sophos VM on a ESXI Server in Test Lab. Both appliances have different Public IP´s for WAN Connection. Both are in Internal Network 192.168.1.1 = Fortigate, 192.168.1.2 = Sophos. 

Yesterday for some strange Reason i received a lot of logs From Sophos that Fortigate (192.168.1.1) has tried to login via SSH on the Sophos Shell with different login Names like root, admin etc. 

Here the logs:

Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:05 with username admin.

Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:00:47 with username monitor.

Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root.

Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root

Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root.

Too many failed logins from 192.168.1.1 for facility sshd.

Further logins will be blocked for 600 seconds.

I Checked the System Log (Local Traffic) on Fortigate and see this:  See atached File

So Fortigate actualy did try to get ssh Accsess on the sophos UTM. 

But there was no Admin Account logged in at this time. and i do not use default credentials like Admin / Password. 

i have a Separate Admin Account with strong password to connect to the Fortigate via Internet. and i always get a Notifikation if i misstape my Password . 

But there were no Notifikations and i dont belive that someone has hacked my password and deleted the logs for admin Accsess, because i do use a FortiAnalyzer as 2nd log Distination and i checked the Logs there. No Admin was logged in at this time. 

Can it be a bug? or do i realy have to worry now :=) i mean its only my test lab. but hey it very STRANGE!

[Dave_Hall · Accepted solution]

Two possible suggestions that could cause this (that I can think of right off the bat); 1) VIP with NAT set on the firewall policy (from WAN to Internal); 2) Vulnerability Scan being performed by the Fortigate.  I'm leaning towards a VIP/firewall w/NAT scenario. 

[Holy]

You are so damn right :=) it was Vulnerability Scan :))  I forgot that i activated them ...

Dave Hall wrote:

Two possible suggestions that could cause this (that I can think of right off the bat); 1) VIP with NAT set on the firewall policy (from WAN to Internal); 2) Vulnerability Scan being performed by the Fortigate.  I'm leaning towards a VIP/firewall w/NAT scenario.