brute force attacks in Fortigate

[unknown1020]

Good day friends.

due to constant news about large scale brute force campaigns targeting SSH devices targeting cisco, fortinet, checkpoint devices. What recommendations could be provided for FortiGate equipment?

[adambomb1219]

Same as any other vendor.  Do not enable admin access from the outside.  Use certificate based authentication, SAML, MFA, etc.

[Marthen]

As mentioned brute force attack is coming for Tor then you can deny all incoming connections from Internet service Tor-Exit.Node  ( don't forget to check match-vip is enabled on deny policy).

[hbac]

Hi @unknown1020,

Please refer to https://docs.fortinet.com/document/fortigate/7.4.0/best-practices/555436/hardening

Regards,